Swift Website Updates & Maintenance https://swiftupdates.ca Swift Website Updates | Wordpress Support Thu, 15 Oct 2026 19:39:02 +0000 en-US hourly 1 https://wordpress.org/?v=7.0.7 https://swiftupdates.ca/wp-content/uploads/2022/11/Screen-Shot-2022-11-10-at-1.41.01-PM.png Swift Website Updates & Maintenance https://swiftupdates.ca 32 32 Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-october-5-2026-to-october-11-2026/ Thu, 15 Oct 2026 19:39:02 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-october-5-2026-to-october-11-2026/ Last week, there were 655 vulnerabilities disclosed in 406 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 366
Unpatched 289

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 8
Medium Severity 377
High Severity 249
Critical Severity 21

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 198
Missing Authorization 112
Deserialization of Untrusted Data 67
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 61
Exposure of Sensitive Information to an Unauthorized Actor 45
Improper Privilege Management 30
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 24
Authorization Bypass Through User-Controlled Key 21
Unrestricted Upload of File with Dangerous Type 18
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 15
Improper Control of Generation of Code (‘Code Injection’) 11
Improper Authentication 9
Cross-Site Request Forgery (CSRF) 8
Client-Side Enforcement of Server-Side Security 7
Incorrect Authorization 6
Server-Side Request Forgery (SSRF) 5
Missing Authentication for Critical Function 3
Uncontrolled Resource Consumption 3
Authentication Bypass Using an Alternate Path or Channel 2
Protection Mechanism Failure 2
Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) 1
Files or Directories Accessible to External Parties 1
Improper Authorization 1
Improper Input Validation 1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) 1
Insertion of Sensitive Information Into Sent Data 1
Loop with Unreachable Exit Condition (‘Infinite Loop’) 1
Use of Cache Containing Sensitive Information 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

61

42

26

26

19

18

16

16

15

13

12

10

8

7

7

7

7

7

6

6

6

6

6

6

6
efd10eb3421a6ca0a3d855ad7029a801
V1T

5

5

5

5

4

4

4

4

4

4

4

4

4

4

3

3

3

3

3

3

3

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2
1e008e2827556f92e4e1199ee59c1c4d
dcs

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
5a50351dc3a5975487697a55ad3936d5
UKO

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
b1c4c306fad16439d9178a0d349f0c40
L4m

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
73f53dafd32993ac7c0157a4e6729638
Bao

1

1
6a866ccafe0dbf0a35a5de5931f3d3ba
fcc

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
f24946464cb425a0ff53578166db2925
R3D

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
10Web Booster – Website speed optimization, Cache & Page Speed optimizer tenweb-speed-optimizer
10WebSocial wd-instagram-feed
3D Product configurator for WooCommerce expivi
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder ablocks
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning academy
Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension
ACPT (Premium) advanced-custom-post-type
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress acymailing
Additional Order Filters for WooCommerce additional-order-filters-for-woocommerce
Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro
Advanced Form Integration — Connect Forms to 300+ Apps advanced-form-integration
Advanced Google reCAPTCHA advanced-google-recaptcha
Advanced IP Blocker advanced-ip-blocker
Advanced Posts Listing – Show Post List Easily advanced-posts-listing
Adwised Web Push Notification adwised
AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display affiliate-toolkit-starter
AI Content Generator Marketing ai-content-generator-marketing
AI Copilot – Content Generator ai-copilot-content-generator
AI Puffer – MCP, AI Chatbot & Content Automation gpt3-ai-content-generator
Airwallex Online Payments Gateway airwallex-online-payments-gateway
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship
All Bootstrap Blocks all-bootstrap-blocks
Animated Number Counters animated-number-counters
Ansar Import – One Click Starter Sites – for WordPress Themes ansar-import
Anton Extensions 4nton-extensions
App for Cloudflare® app-for-cf
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint
Appointment Bookings for Zoom GoogleMeet and more – Wappointment wappointment
ARforms arforms
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup armember
Asgaros Forum asgaros-forum
ASPL Product Quotation aspl-product-quotation
Aurora Heatmap aurora-heatmap
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI automatorwp
AutoPoly – AI Translation For Polylang automatic-translations-for-polylang
Autoship Cloud for WooCommerce Subscription Products autoship-cloud
Avada (Fusion) Builder fusion-builder
AWP Classifieds another-wordpress-classifieds-plugin
BackWPup – WordPress Backup & Restore Plugin backwpup
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
Bayarcash WooCommerce bayarcash-wc
bBlocks – Essential Gutenberg Blocks & Patterns Collection b-blocks
Before After Image Comparison – Visual Comparison for Two Images before-after-image-compare
Blocksy Companion blocksy-companion
Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor
Booking Calendar booking
Booking Package booking-package
Booknetic booknetic
Booktics – Appointment Booking Calendar for Service Businesses booktics
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools woocommerce-jetpack
Bricksforge bricksforge
Brizy – Page Builder brizy
BuddyBoss Platform buddyboss-platform
BuddyPress Instant Chat bp-instant-chat
Builderius – Landing Page Builder + Dynamic Templates builderius
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms captcha-bws
CF7 Views – Complete Entry Management for Contact Form 7 cf7-views
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) charitable
Church Admin church-admin
click5 CRM add-on to Contact Form 7 cf7-add-on-by-click5
click5 CRM add-on to Gravity Forms gf-add-on-by-click5
click5 CRM add-on to Ninja Forms click5-crm-add-on-to-ninja-forms
click5 CRM add-on to WPForms wpf-add-on-by-click5
Code Snippets code-snippets
CodeBard Help Desk codebard-help-desk
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db
Content Visibility for Divi Builder content-visibility-for-divi-builder
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery
CP Media Player – Audio Player and Video Player audio-and-video-player
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators creatorlms
Crowdfundly crowdfundly
CURCY – Multi Currency for WooCommerce woo-multi-currency
Dashboard Notes dashboard-notes
Data Tables Generator by Supsystic data-tables-generator-by-supsystic
Database Addon For WPForms ( wpforms entries ) – WPFormsDB database-for-wpforms
Database for CF7 database-for-cf7
Datalist it datalistit
Directory Listings WordPress plugin – uListing ulisting
DirectoryPress – Business Directory And Classified Ad Listing directorypress
Disable Users disable-users
Divi Plus divi-plus
Doctreat Core doctreat_core
Document Embedder – let visitors read files without downloading document-emberdder
Document Gallery document-gallery
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy dokan-lite
Download Manager download-manager
DTX – Dynamic Text Extension for Contact Form 7 contact-form-7-dynamic-text-extension
Dynamic User Directory dynamic-user-directory
E-cab Taxi Booking Manager for Woocommerce ecab-taxi-booking-manager
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy easy-digital-downloads
eCommerce Product Catalog ecommerce-product-catalog
Edwiser Bridge – WordPress Moodle Integration edwiser-bridge
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons bdthemes-element-pack-lite
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) elex-bulk-edit-products-prices-attributes-for-woocommerce-basic
Email Marketing for WordPress and WooCommerce – Retainful retainful
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files embed-any-document
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More envira-gallery-lite
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams eroom-zoom-meetings-webinar
Event Tickets and Registration event-tickets
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce wp-event-solution
Events Manager – Calendar, Bookings, Tickets, Appointments and more! events-manager
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin everest-backup
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) extensions-for-cf7
Fastcache by Host.it fastcache-by-host-it
Favicon Rotator favicon-rotator
Filter Everything — WordPress & WooCommerce Filters filter-everything
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment firebox
Fluent Affiliate Pro fluent-affiliate-pro
Fluent Booking Pro fluent-booking-pro
Fluent Forms Pro Add On Pack fluentformpro
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder fluentform
Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu
FooSales – Point of Sale (POS) for WooCommerce foosales
Form Block form-block
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
Freeton WP freeton-wp
Front End PM front-end-pm
Frontend Admin by DynamiApps acf-frontend-form-element
Frontend Dashboard frontend-dashboard
Fundiin cho WooCommerce fundiin
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout funnel-builder
FV Flowplayer Video Player fv-wordpress-flowplayer
FV Player 8 fv-player
Gallery PhotoBlocks photoblocks-grid-gallery
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI gamipress
GDPR Data Request Form gdpr-data-request-form
Geliver Akıllı Kargo Pazaryeri geliver-akilli-kargo-pazaryeri
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
Getwid – Gutenberg Blocks getwid
GIFT4U – Gift Cards All in One for Woo gift4u-gift-cards-all-in-one-for-woo
GiveWP – Donation Plugin and Fundraising Platform give
Gloria Admin Panel gloria-admin-panel
Gmedia Photo Gallery grand-media
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI gptranslate
Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs
Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates happy-elementor-addons
Hello Plus hello-plus
HireZoot – Job Listings, Career Page & Recruitment Tool wp-job-openings
HivePress – Business Directory, Listings & Classified Ads Plugin hivepress
HollerBox — Fast & Effective Popups & Lead-Generation holler-box
HootBoard – Bulletin Board For Your Organization & Team Communication hootboard
Hotel Booking nd-booking
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player html5-audio-player
HTTP Requests Manager http-requests-manager
Hustle – Email Marketing, Lead Generation, Optins, Popups wordpress-popup
If-So Dynamic Content – Elementor & All Page Builders Personalization if-so
Image Optimizer, Resizer and CDN – Sirv sirv
Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite
Image Slider image-slider-widget
Import and export users and customers import-users-from-csv-with-meta
Instapage Plugin instapage
Insurify – Order & Shipping Protection insurify
Integration for Epos Now and WooCommerce woo-epos-now-integration
JetBlocks for Elementor jet-blocks
JetElements jet-elements
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
Jetpack VideoPress jetpack-videopress
Jetpack – WP Security, Backup, Speed, & Growth jetpack
Job Postings job-postings
Jotform – AI Chatbot jotform-ai-chatbot
JS Help Desk – AI-Powered Support & Ticketing System js-support-ticket
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor kadence-blocks
KeyWord Collector keyword-collector
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce
Koinonia Link koinonia-link
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes rocket-lazy-load
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
Leyka leyka
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes lifterlms
Listdom: AI-powered Business Directory with Classifieds Ads Listings listdom
ListingPro Plugin listingpro-plugin
Livees Checkout livees-checkout
Llavero.io llavero-io
Login Lockdown & Protection login-lockdown
Logo Showcase – Logo Slider, Carousel & Sponsors Gallery logo-showcase
Loja Automática loja-automatica
LTL Freight Quotes – ODFL Edition ltl-freight-quotes-odfl-edition
Magee Shortcodes magee-shortcodes
Mailjet Email Marketing mailjet-for-wordpress
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites mainwp-child
Mapster WP Maps mapster-wp-maps
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
Media Library Assistant media-library-assistant
Memberful – Membership Plugin memberful-wp
MemberHero – Simple User Registration & Login wp-registration
Meta Box AIO meta-box-aio
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet paid-membership
Midtrans-WooCommerce midtrans-woocommerce
Mindstien Quick Login mindstien-quick-login
miniOrange OTP Login, Verification and SMS Notifications miniorange-otp-verification
Mobile builder mobile-builder
Modula Image Gallery – Photo Grid & Video Gallery modula-best-grid-gallery
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress molongui-authorship
Morning for WooCommerce wc-gateway-greeninvoice
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar mp3-music-player-by-sonaar
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO multiple-pages-generator-by-porthas
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor
Museder RestoreOne museder-restoreone
Music Store – WordPress eCommerce music-store
Name Directory name-directory
Newsletter Subscription Form – User Subscriptions Form, Capture Email newsletter-subscription-form
Nexi XPay Build nexi-xpay-build
Noptin – Newsletter, New Post Notifications & Email Automation newsletter-optin-box
Norvis Backup norvis-backup
Ocean eComm Treasure Box ocean-ecommerce
Ocean Pro Demos ocean-pro-demos
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. host-webfonts-local
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Order Export & Order Import for WooCommerce order-import-export-for-woocommerce
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway cryptocurrency-payments-using-metamask-for-woocommerce
payever – WooCommerce Gateway payever-woocommerce-gateway
paymendo – Bank Transfer (Lite) paymendo-bank-transfer
Payment Plugins for Stripe WooCommerce woo-stripe-payment
PayPlug for WooCommerce (Official) payplug
PDF Invoices & Packing Slips for WooCommerce – Challan webappick-pdf-invoice-for-woocommerce
peepso peepso
PeproDev Ultimate Profile Solutions peprodev-ups
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Photo Reviews for WooCommerce woo-photo-reviews
picu – Online Photo Proofing Gallery picu
Piotnet Addons For Elementor piotnet-addons-for-elementor
Piotnet Forms piotnetforms
Pix por Piggly (para Woocommerce) pix-por-piggly
Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress
Polylang polylang
Portfolio Filter Gallery – Photo Gallery portfolio-filter-gallery
Porto Theme – Functionality porto-functionality
Post Export Import with Media post-export-import-with-media
Post Grid Gutenberg Blocks – PostX ultimate-post
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App post-smtp
Post Snippets – Custom WordPress Code Snippets Customizer post-snippets
Post title marquee scroll post-title-marquee-scroll
Post Voting System post-voting-system
PowerPress Podcasting plugin by Blubrry powerpress
PPOM – Product Addons & Custom Fields for WooCommerce woocommerce-product-addon
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates premium-addons-for-elementor
Premium Packages – Sell Digital Products Securely wpdm-premium-packages
Prenotazioni prenotazioni
Presto Player presto-player
Presto Player Pro presto-player-pro
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons bdthemes-prime-slider-lite
Product Configurator for WooCommerce product-configurator-for-woocommerce
Product Designer for WooCommerce WordPress | Lumise lumise
Pubjet | پاب‌جت pubjet
QA Assistants – Driven by data qa-heatmap-analytics
Qode Music qode-music
Qode Real Estate qode-real-estate
Qode Tours qode-tours
QR Redirector qr-redirector
Quick quotes – WPSHARE247 quick-quotes-wpshare247
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker quiz-master-next
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events radius-booking
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings seo-by-rank-math
Real Estate Manager – Property Listing and Agent Management real-estate-manager
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder real3d-flipbook-lite
Recordbrowser recordbrowser
Redux Framework redux-framework
Responsive Lightbox & Gallery responsive-lightbox
Restrict User Access – Ultimate Membership & Content Protection restrict-user-access
Robo Gallery – Photo & Image Slider robo-gallery
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator feedzy-rss-feeds
rtMedia for WordPress, BuddyPress and bbPress buddypress-media
SafeSnap – Verified WordPress Backup & Restore safesnap
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas salon-booking-system
Scripts n Styles scripts-n-styles
Sell Downloads sell-downloads
SendPress Newsletters sendpress
Shipping for Nova Poshta nova-poshta-ttn
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel-image-optimiser
Simple File List simple-file-list
Simple JWT Login – Allows you to use JWT on REST endpoints. simple-jwt-login
Simple Membership simple-membership
Simply Schedule Appointments simply-schedule-appointments
Site Setup Wizard site-setup-wizard
Sitemovr sitemovr
SiteOrigin Widgets Bundle so-widgets-bundle
SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration
SKU Error Fixer for WooCommerce sku-error-fixer-for-woocommerce
Slider by 10Web – Responsive Image Slider slider-wd
Smart Popup by Supsystic popup-by-supsystic
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery sms-alert
SmugMug Embed smugmug-embed
Snapshotify – All-in-One Backup & Restore & Migrate snapshotify
Social Rocket – Social Sharing Plugin social-rocket
Social Share Icons & Social Share Buttons ultimate-social-media-plus
Social Web Suite – Social Media Auto Post, Social Media Auto Publish social-web-suite
Spam Protection for Forms & Comments. Anti-Spam by CleanTalk cleantalk-spam-protect
SpeedyCache – Cache, Optimization, Performance speedycache
Squadeno – Club Sports Manager squadeno-club-sports-manager
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg astra-sites
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce storegrowth-sales-booster
StreamCast – bring live radio to your site with a sleek player streamcast
String locator string-locator
Subscribe to Comments subscribe-to-comments
Super Forms – Drag & Drop Form Builder super-forms
Super Payments – WooCommerce Payment Gateway super-payments
Super Video player – Fully Customizable Video Player with Playlist super-video-player
SureDash – Community, Courses & Member Dashboard suredash
Swish Migrate and Backup swish-migrate-and-backup
Table Field Add-on for ACF and SCF advanced-custom-fields-table-field
Tabs Responsive – With WooCommerce Product Tabs Extension tabs-responsive
Tailored Tools tailored-tools
Tainacan tainacan
Taskbot taskbot
Tcard WP tcard-wp
Team Section Block – Showcase Team Members with Layout Options team-section
Team – Team Members Showcase Plugin tlp-team
Testimonials by BestWebSoft bws-testimonials
Thanko Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer
The GDPR Framework By Data443 gdpr-framework
ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras
Tickera – Sell Tickets & Manage Events tickera-event-ticketing-system
Tonda Membership tonda-membership
Topcontent topcontent
Tourfic Pro tourfic-pro
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping track-orders-for-woocommerce
TrueBooker – Appointment Booking and Scheduler System truebooker-appointment-booking
Tutor LMS – eLearning and online course solution tutor
uDesign | Multipurpose WordPress Theme u-design-core
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform ultimate-multisite
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets ultimate-post-kit
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included uncanny-automator
UnitechPay – Wave & Orange Money Payments unitechpay-paiements-mobile-money
Unlimited Elements for Elementor unlimited-elements-for-elementor
Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration upcasted-s3-offload
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission wp-user-frontend
User Private Files – Secure File Sharing and Client Portal Plugin user-private-files
Veeqo for WooCommerce veeqo-for-woocommerce
Video Background Block – Add Stunning Video Backgrounds to Any Section video-background-block
Video Conferencing with Zoom video-conferencing-with-zoom-api
VikBooking Hotel Booking Engine & PMS vikbooking
VikRentCar Car Rental Management System vikrentcar
VillaTheme Core villatheme-core
Visual Composer Website Builder visualcomposer
Vitepos – Point of Sale (POS) for WooCommerce vitepos-lite
W3 Total Cache w3-total-cache
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments wallet-system-for-woocommerce
WC Fields Factory wc-fields-factory
WCFM – Multivendor Marketplace REST API for WooCommerce wcfm-marketplace-rest-api
Web Plura Backup & Restore – Local Backups, Restore & Recovery web-plura-backup-restore-manager
Web Vitals Tracking web-vitals-tracking
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels print-invoices-packing-slip-labels-for-woocommerce
WeddingCity Lite – Wedding Directory and Listing weddingcity-lite
Wise Chat wise-chat
WooCommerce woocommerce
WooCommerce Bookings woocommerce-bookings
WooCommerce Simple Auctions woocommerce-simple-auctions
Wordable – Export Google Docs to WordPress wordable
Workreap Core workreap_core
WP 2FA – Two-factor authentication for WordPress wp-2fa
WP Admin Audit wp-admin-audit
WP Associate Post R2 wp-associate-post-r2
WP Booking System – Booking Calendar wp-booking-system
WP Coder – Insert & Manage Code Snippets wp-coder
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments delete-all-comments-of-website
WP CV Builder cv-builder
WP Directory Kit wpdirectorykit
WP Dummy Content Generator wp-dummy-content-generator
WP Duplicate – WordPress Migration Plugin local-sync
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce wp-event-manager
WP File Download wp-file-download
WP Mailster wp-mailster
WP Meteor Website Speed Optimization Addon wp-meteor
WP Photo Album Plus wp-photo-album-plus
WP Plugin Info Card wp-plugin-info-card
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars wp-post-author
WP Posts Password Batch Manager wp-posts-password-batch-manager
WP Rocket wp-rocket
WP Rollback – Rollback Plugins and Themes wp-rollback
WP Store Locator wp-store-locator
WP Synchro – The Ultimate WordPress Migration Tool wpsynchro
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export wp-ultimate-csv-importer
WP User Profiles wp-user-profiles
WP Verify API wp-verify-api
WP-Invoice – Web Invoice and Billing wp-invoice
WP-Partner wp-partner
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden wp2leads
WPAdverts – Classifieds Plugin wpadverts
WPBase Cache wpbase-cache
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System wp-cafe
WPCOM Member wpcom-member
WPComplete wpcomplete
WpCues Basic Quiz wpcues-basic-quiz
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More wpforms-lite
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell wpfunnels
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode gdpr-cookie-consent
WPML Multilingual & Multicurrency for WooCommerce woocommerce-multilingual
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) wpo365-login
wpsection wpsection
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress wpvr
WXD Backup Lite wxd-backup-lite
XServer Migrator xserver-migrator
Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc
YITH WooCommerce Affiliates yith-woocommerce-affiliates
YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons
YITH WooCommerce Product Bundles yith-woocommerce-product-bundles
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress youzify
Zero Spam for WordPress zero-spam
Zotpress zotpress

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Aalto – Architecture and Interior Design WordPress Theme aalto
Alliance | Intranet & Extranet BuddyPress WordPress Theme alliance
Ambed – Wallpapers & Painting Services WordPress Theme ambed
Ambient – Modern Interior Design and Decoration WordPress Theme ambient
Anesta – Intranet, Extranet, Community and BuddyPress WordPress Theme anesta
Angio – Creative Music Theme angio
Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) armania
asia-garden asia-garden
Avada | Website Builder For WordPress & WooCommerce Avada
Avala – Wedding & Event WordPress Theme avala
Backhoe – Construction Equipment Rentals WordPress Theme backhoe
Balance balance
Biolife – Organic Food WordPress Theme ( RTL Supported ) biolife
Booklovers – Publishing House, Bookshop & BookStore WordPress Theme + RTL booklovers
Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) kute-boutique
Buzz Stone | Magazine & Viral Blog WordPress Theme buzzstone
Camelia | Floral Studio Florist WordPress Theme camelia
Cardea – Portfolio One Page WordPress Theme cardea-wp
CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor cleanskin
colorit colorit
Convex – Architecture & Interior Design WordPress Theme convex
DK dk
Doctreat – Hospitals and Doctors Directory WordPress Listing Theme doctreat
Drone Media | Aerial Photography & Videography Theme drone-media
Duka Market – Multipurpose eCommerce Template dukamarket
Dwell – Building, Construction & Renovation Theme dwell
Edema | Wellness & Spa WordPress Theme edema
Education Center | LMS & Online Courses WordPress Theme education
Educavo – Education WordPress Theme educavo
EduMall – Professional LMS Education Center WordPress Theme edumall
Equadio equadio
Fabius – One Page Resume WordPress Theme fabius-wp
FC United | Football, Soccer & Sports WordPress Theme + Events & Shop fcunited
Flipmart – MegaOne Multipurpose WordPress Theme flipmart
FoodBakery | Food Delivery Single & Multiple Restaurant Template foodbakery
grandnews grandnews
Graphene graphene
Greeny – Electric Car Dealership WordPress Theme greeny
Grocery Shopping Store grocery-shopping-store
Gutentype | 100% Gutenberg Blog Theme + Elementor gutentype
Hogwords | School, University Education WordPress Theme hogwords
Hygia – Cleaning Services WordPress Theme hygia
Invetex invetex
iPharm – Online Pharmacy Woocommerce Elementor Template Kit ipharm
jacqueline jacqueline
Jannah – Newspaper Magazine News BuddyPress AMP jannah
JobZilla – Job Board WordPress Theme jobzilla
Juno | Kids Toys & Games Store WordPress Theme junotoys
Kalles – Clean, Versatile, Responsive Shopify Theme – RTL support kalles
Kaven – Business One Page WordPress Theme kaven-wp
Kicker – Blog Magazine Theme kicker
Kids Planet – Children Kindergarten and Playgroup WordPress Theme kidsplanet
kidscare kidscare
kuteshop kuteshop
Law Office law-office
Let’s Play | Hockey School & Winter Sports WordPress Theme playhockey
LMS – Education WordPress Theme lms
Martfury – Marketplace Mobile App Figma Template martfury
Motors – Car Dealer, Rental & Listing WordPress theme motors
N7 n7-golf-club
Neo | Barber Shop WordPress Theme neocut
Ogency – Web Design Agency WordPress Theme ogency
Original original
Ozeum | Art Gallery and Museum Theme ozeum
Partiso | Political Party & Candidate Elementor Template Kit partiso
Photolia | Photo Company & Supply Store WordPress Theme photolia
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission pin-wp
Qwery – Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT qwery
Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme rosalinda
ShiftCV – Blog Resume Portfolio WordPress Theme shift-cv
Smart Casa | Home Automation & House Technologies WordPress Theme smart-casa
Smash – Tennis WordPress Theme smash
Splendour splendour
Stargaze stargaze
Tantra | Yoga Studio and Fitness Club WordPress Theme tantra
TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) techone
Teoro – One Page WordPress Theme teoro-wp
Th Shop Mania th-shop-mania
The Voux – A Multipurpose News & Magazine WordPress Theme thevoux-wp
The7 — Website and eCommerce Builder for WordPress dt-the7
tipsy tipsy
TouchUp – Cosmetic and Plastic Surgery WordPress Theme touchup
Travel Booking WordPress Theme traveler
Travesia | Travel Agency and Tour Booking WordPress Theme travesia
Treck – Immigration and Visa Consulting WordPress Theme treck
TutorStarter tutorstarter
Uminex – Multipurpose WooCommerce Theme uminex
Veto – Politics, Campaign & Candidate WordPress Theme veto
Voldor – Welding & Metal Work WordPress Theme voldor
Volos – One Page Resume WordPress Theme volos-wp
Werkstatt – Creative Portfolio WordPress Theme werkstatt
Whistle – Sports Clothing & Fitness Equipment whistle-sports-club
Windsor – Apartment Complex Single Property WordPress Theme windsor
Wine House | Winery & Restaurant WordPress Theme wine-house
WineShop – Food & Wine Store WordPress Theme wineshop
Woffice CRM woffice
WP Rentals – Booking Accommodation WordPress Theme wprentals
WPLMS Learning Management System for WordPress, WordPress LMS wplms
Yacht Rental – Boat Services WordPress Theme yacht-rental
Zeinet – Internet Provider & Satellite TV zeinet

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

3D Product configurator for WooCommerce <= 2.16.2 – Unauthenticated Remote Code Execution via ‘xpv_image’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-103889
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

3D Product configurator for WooCommerce [expivi]

Researcher

More Details >

Advanced IP Blocker <= 8.13.13 – Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-104732
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Advanced IP Blocker [advanced-ip-blocker]

Researcher

More Details >

Anton Extensions <= 1.2.2 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-104028
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Anton Extensions [4nton-extensions]

Researchers

More Details >

Bricksforge <= 3.1.8.9 – Unauthenticated Arbitrary File Upload via ‘temporaryFileUploads’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-85097
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Bricksforge [bricksforge]

Researcher

More Details >

Doctreat – Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-39770
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Doctreat – Hospitals and Doctors Directory WordPress Listing Theme [doctreat]

Researcher

More Details >

Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.13 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-39802
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin [everest-backup]

Researcher

More Details >

Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 – Unauthenticated Arbitrary File Upload via Signature Field File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-94589
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) [extensions-for-cf7]

Researcher

More Details >

Freeton WP <= 1.0.0 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-84737
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Freeton WP [freeton-wp]

Researcher

More Details >

Mindstien Quick Login <= 1.0 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-84734
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Mindstien Quick Login [mindstien-quick-login]

Researcher

More Details >

SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-42696
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

SiteVault – Backup, Restore, Migration & Cloning [sitevault-backup-restore-migration]

Researcher

More Details >

SMS Alert <= 4.0.0 – Unauthenticated Arbitrary Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-94256
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]

Researcher

More Details >

Tailored Tools <= 3.0.3 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-62025
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Tailored Tools [tailored-tools]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

Tonda Membership <= 1.0.1 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-62022
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Tonda Membership [tonda-membership]

Researcher

More Details >

Tourfic Pro <= 1.17.3 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-39774
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Tourfic Pro [tourfic-pro]

Researcher

More Details >

WPCOM Member <= 1.7.27 – Unauthenticated Authentication Bypass via ‘uuid’ and ‘code’ Parameters on Social-Login Callback

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-104803
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WPCOM Member [wpcom-member]

Researcher

More Details >

Avada (Fusion) Builder <= 3.16.1 – Unauthenticated Arbitrary WordPress Action Invocation via ‘{action_hook}’ Dynamic-Data Token in Form Field

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-97670
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researchers

More Details >

Blocksy Companion <= 2.1.58 – Unauthenticated Privilege Escalation to ‘role’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-107645
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Blocksy Companion [blocksy-companion]

Researcher

More Details >

PPOM <= 34.0.10 – Unauthenticated Arbitrary File Deletion via ‘ppom[fields][<data_name>][n][org]’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-104801
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

PPOM – Product Addons & Custom Fields for WooCommerce [woocommerce-product-addon]

Researcher

More Details >

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-105892
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

More Details >

Simple File List <= 6.3.11 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-39792
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Simple File List [simple-file-list]

Researcher

More Details >

Super Forms <= 6.3.316 – Unauthenticated Arbitrary Directory Deletion via ‘data[…][files][][subdir]’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-17609
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

More Details >

ACPT (Premium) <= 2.0.66 – Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-105701
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

ACPT (Premium) [advanced-custom-post-type]

Researcher

More Details >

Appointment Booking Plugin <= 5.7.3 – Authenticated (Custom+) Privilege Escalation to ‘settings[default_wp_role_for_customer]’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-104766
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

CodeBard Help Desk <= 1.1.2 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-62024
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

CodeBard Help Desk [codebard-help-desk]

Researcher

More Details >

Content Visibility for Divi Builder <= 5.03 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-39725
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Content Visibility for Divi Builder [content-visibility-for-divi-builder]

Researcher

More Details >

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 – Authenticated (Contributor+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-62129
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms]

Researcher

More Details >

Crowdfundly <= 2.2.2 – Authenticated (Crowdfundly Manager+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-85126
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Crowdfundly [crowdfundly]

Researcher

More Details >

FooSales <= 1.43.0 – Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-77183
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

FooSales – Point of Sale (POS) for WooCommerce [foosales]

Researcher

More Details >

FV Player 8 <= 8.1.7 – Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-83526
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

FV Player 8 [fv-player]

Researcher

More Details >

Groundhogg <= 4.9 – Authenticated (Custom+) Privilege Escalation to ‘user’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-104725
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

LifterLMS <= 10.2.1 – Authenticated (Custom+) PHP Object Injection via ‘custom’ Lesson Data

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-104723
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes [lifterlms]

Researcher

More Details >

Super Forms <= 6.3.316 – Authenticated (Subscriber+) Arbitrary File Upload via ‘extensions’ Form Element Attribute

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-17196
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

More Details >

Taskbot <= 6.6 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-39757
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Taskbot [taskbot]

Researcher

More Details >

Veeqo for WooCommerce <= 2.2.8 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-93550
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Veeqo for WooCommerce [veeqo-for-woocommerce]

Researcher

More Details >

Workreap Core <= 3.4.5 – Authenticated (Employer / Sales Representative+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-39759
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Workreap Core [workreap_core]

Researcher

More Details >

WP Duplicate – WordPress Migration Plugin <= 1.1.11 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-39755
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WP Duplicate – WordPress Migration Plugin [local-sync]

Researcher

More Details >

Aalto – Architecture and Interior Design WordPress Theme <= 1.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42777
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Aalto – Architecture and Interior Design WordPress Theme [aalto]

Researcher

More Details >

Advanced Form Integration <= 2.9.0 – Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-104797
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Advanced Form Integration — Connect Forms to 300+ Apps [advanced-form-integration]

Researcher

More Details >

AFFI – Affiliate Marketing for WooCommerce <= 1.0.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-104398
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

AFFI – Affiliate Marketing for WooCommerce [affi-affiliate-marketing-for-woo]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

Alliance | Intranet & Extranet BuddyPress WordPress Theme <= 3.11 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-78529
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Alliance | Intranet & Extranet BuddyPress WordPress Theme [alliance]

Researcher

More Details >

Ambient <= 1.7 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66566
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Ambient – Modern Interior Design and Decoration WordPress Theme [ambient]

Researcher

More Details >

Anesta – Intranet, Extranet, Community and BuddyPress WordPress Theme <= 1.5.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66567
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Anesta – Intranet, Extranet, Community and BuddyPress WordPress Theme [anesta]

Researcher

More Details >

Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62092
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) [armania]

Researcher

More Details >

Asia Garden <= 1.3.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62125
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

asia-garden [asia-garden]

Researcher

More Details >

Avala <= 1.1.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62077
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Avala – Wedding & Event WordPress Theme [avala]

Researcher

More Details >

Backhoe <= 2.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62075
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Backhoe – Construction Equipment Rentals WordPress Theme [backhoe]

Researcher

More Details >

Balance <= 1.12.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93945
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Balance [balance]

Researcher

More Details >

Biolife – Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62096
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Biolife – Organic Food WordPress Theme ( RTL Supported ) [biolife]

Researcher

More Details >

Booklovers – Publishing House, Bookshop & BookStore WordPress Theme + RTL <= 2.13.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62045
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Booklovers – Publishing House, Bookshop & BookStore WordPress Theme + RTL [booklovers]

Researcher

More Details >

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.4.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42718
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]

Researcher

More Details >

Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62099
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]

Researcher

More Details >

Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-81797
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Buzz Stone | Magazine & Viral Blog WordPress Theme [buzzstone]

Researcher

More Details >

Camelia | Floral Studio Florist WordPress Theme <= 1.2.15 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93944
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Camelia | Floral Studio Florist WordPress Theme [camelia]

Researcher

More Details >

Cardea <= 2.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62065
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Cardea – Portfolio One Page WordPress Theme [cardea-wp]

Researcher

More Details >

CleanSkin <= 1.5.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42724
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor [cleanskin]

Researcher

More Details >

CleanSkin <= 1.5.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42723
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor [cleanskin]

Researcher

More Details >

Convex – Architecture & Interior Design WordPress Theme <= 1.16.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93943
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Convex – Architecture & Interior Design WordPress Theme [convex]

Researcher

More Details >

DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.27 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62032
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

DirectoryPress – Business Directory And Classified Ad Listing [directorypress]

Researcher

More Details >

Drone Media | Aerial Photography & Videography Theme <= 2.2.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66482
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Drone Media | Aerial Photography & Videography Theme [drone-media]

Researcher

More Details >

Duka Market – Multipurpose eCommerce Template <= 1.3.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-48194
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Duka Market – Multipurpose eCommerce Template [dukamarket]

Researcher

More Details >

Dwell – Building, Construction & Renovation Theme <= 1.16.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93942
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Dwell – Building, Construction & Renovation Theme [dwell]

Researcher

More Details >

Edema | Wellness & Spa WordPress Theme <= 1.2.2.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93941
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Edema | Wellness & Spa WordPress Theme [edema]

Researcher

More Details >

Education Center <= 3.6.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66483
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Education Center | LMS & Online Courses WordPress Theme [education]

Researcher

More Details >

Equadio <= 1.1.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62087
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Equadio [equadio]

Researcher

More Details >

Fabius – One Page Resume WordPress Theme <= 1.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62069
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Fabius – One Page Resume WordPress Theme [fabius-wp]

Researcher

More Details >

FC United <= 1.1.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66565
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

FC United | Football, Soccer & Sports WordPress Theme + Events & Shop [fcunited]

Researcher

More Details >

Flipmart – MegaOne Multipurpose WordPress Theme <= 2.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62070
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Flipmart – MegaOne Multipurpose WordPress Theme [flipmart]

Researcher

More Details >

FoodBakery <= 4.6 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-78530
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

FoodBakery | Food Delivery Single & Multiple Restaurant Template [foodbakery]

Researcher

More Details >

GeoDirectory <= 2.8.187 – Unauthenticated Local File Inclusion via ‘design_type’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-104899
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

More Details >

Greeny – Electric Car Dealership WordPress Theme <= 2.10.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93940
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Greeny – Electric Car Dealership WordPress Theme [greeny]

Researcher

More Details >

Groundhogg <= 4.8.3 – Unauthenticated Privilege Escalation to Support User Identity Confusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-92975
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Gutentype | 100% Gutenberg Blog Theme + Elementor <= 2.1.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62046
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Gutentype | 100% Gutenberg Blog Theme + Elementor [gutentype]

Researcher

More Details >

Hogwords | School, University Education WordPress Theme <= 1.2.7 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93938
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Hogwords | School, University Education WordPress Theme [hogwords]

Researcher

More Details >

Hygia – Cleaning Services WordPress Theme <= 1.21.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93937
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Hygia – Cleaning Services WordPress Theme [hygia]

Researcher

More Details >

Invetex <= 2.18 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62123
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Invetex [invetex]

Researcher

More Details >

iPharm – Online Pharmacy Woocommerce Elementor Template Kit <= 1.2.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93936
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

iPharm – Online Pharmacy Woocommerce Elementor Template Kit [ipharm]

Researcher

More Details >

Jacqueline | Spa & Massage Salon Beauty Theme <= 2.22 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-78531
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

jacqueline [jacqueline]

Researcher

More Details >

Job Postings <= 2.8.2 – Authenticated (Contributor+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-39752
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Job Postings [job-postings]

Researcher

More Details >

Juno <= 2.25 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62086
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Juno | Kids Toys & Games Store WordPress Theme [junotoys]

Researcher

More Details >

Kalles <= 1.1.7.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62076
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Kalles – Clean, Versatile, Responsive Shopify Theme – RTL support [kalles]

Researcher

More Details >

Kaven <= 1.2 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62067
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Kaven – Business One Page WordPress Theme [kaven-wp]

Researcher

More Details >

Kicker – Blog Magazine Theme <= 2.2.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66569
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Kicker – Blog Magazine Theme [kicker]

Researcher

More Details >

Kids Care <= 3.2.4 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42704
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

kidscare [kidscare]

Researcher

More Details >

KuteShop <= 4.2.9 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62115
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

kuteshop [kuteshop]

Researcher

More Details >

Law Office <= 3.20 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62120
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Law Office [law-office]

Researcher

More Details >

Let’s Play | Hockey School & Winter Sports WordPress Theme <= 1.1.15 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93935
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Let’s Play | Hockey School & Winter Sports WordPress Theme [playhockey]

Researcher

More Details >

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-105436
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child]

Researcher

More Details >

N7 <= 2.21 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62124
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

N7 [n7-golf-club]

Researcher

More Details >

Original <= 1.9.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66568
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Original [original]

Researcher

More Details >

Ozeum | Art Gallery and Museum Theme <= 1.3.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62074
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Ozeum | Art Gallery and Museum Theme [ozeum]

Researcher

More Details >

Partiso | Political Party & Candidate Elementor Template Kit <= 1.1.13 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93934
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Partiso | Political Party & Candidate Elementor Template Kit [partiso]

Researcher

More Details >

payever – WooCommerce Gateway <= 4.8.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42716
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

payever – WooCommerce Gateway [payever-woocommerce-gateway]

Researcher

More Details >

PeepSo <= 9.0.5.4 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-40805
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

peepso [peepso]

Researcher

More Details >

Photolia | Photo Company & Supply Store WordPress Theme <= 1.0.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-78535
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Photolia | Photo Company & Supply Store WordPress Theme [photolia]

Researcher

More Details >

Presto Player Pro <= 3.0.1 – Authenticated (Author+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66481
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Presto Player Pro [presto-player-pro]

Researcher

More Details >

Qwery – Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT <= 3.6.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-78533
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Qwery – Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT [qwery]

Researcher

More Details >

Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme <= 1.2.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93933
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme [rosalinda]

Researcher

More Details >

ShiftCV – Blog Resume Portfolio WordPress Theme <= 3.0.14 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66564
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

ShiftCV – Blog Resume Portfolio WordPress Theme [shift-cv]

Researcher

More Details >

Smart Casa | Home Automation & House Technologies WordPress Theme <= 1.0.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93932
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Smart Casa | Home Automation & House Technologies WordPress Theme [smart-casa]

Researcher

More Details >

Smash – Tennis WordPress Theme <= 1.12.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93931
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Smash – Tennis WordPress Theme [smash]

Researcher

More Details >

Splendour <= 1.23 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62050
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Splendour [splendour]

Researcher

More Details >

Stargaze <= 1.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62051
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Stargaze [stargaze]

Researcher

More Details >

String Locator <= 2.6.7 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-97188
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

String locator [string-locator]

Researcher

More Details >

Tantra | Yoga Studio and Fitness Club WordPress Theme <= 2.9.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93930
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Tantra | Yoga Studio and Fitness Club WordPress Theme [tantra]

Researcher

More Details >

TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62094
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) [techone]

Researcher

More Details >

Teoro <= 1.1 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62068
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Teoro – One Page WordPress Theme [teoro-wp]

Researcher

More Details >

The GDPR Framework By Data443 <= 2.5.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-39797
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

The GDPR Framework By Data443 [gdpr-framework]

Researcher

More Details >

The Voux <= 6.9.5 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-94067
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

The Voux – A Multipurpose News & Magazine WordPress Theme [thevoux-wp]

Researcher

More Details >

Tipsy <= 1.6 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62052
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

tipsy [tipsy]

Researcher

More Details >

TouchUp < 1.4 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62020
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

TouchUp – Cosmetic and Plastic Surgery WordPress Theme [touchup]

Researcher

More Details >

Travesia | Travel Agency and Tour Booking WordPress Theme <= 1.1.16 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93929
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Travesia | Travel Agency and Tour Booking WordPress Theme [travesia]

Researcher

More Details >

Uminex – Multipurpose WooCommerce Theme <= 1.0.9 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-48193
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Uminex – Multipurpose WooCommerce Theme [uminex]

Researcher

More Details >

Veto <= 1.6.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-93927
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Veto – Politics, Campaign & Candidate WordPress Theme [veto]

Researcher

More Details >

Volos <= 1.2 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62066
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Volos – One Page Resume WordPress Theme [volos-wp]

Researcher

More Details >

Werkstatt – Creative Portfolio WordPress Theme <= 4.8.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-94062
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Werkstatt – Creative Portfolio WordPress Theme [werkstatt]

Researcher

More Details >

Windsor – Apartment Complex Single Property WordPress Theme <= 2.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-66563
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Windsor – Apartment Complex Single Property WordPress Theme [windsor]

Researcher

More Details >

Wine House | Winery & Restaurant WordPress Theme <= 3.20 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62053
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Wine House | Winery & Restaurant WordPress Theme [wine-house]

Researcher

More Details >

WineShop – Food & Wine Store WordPress Theme <= 3.20 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62090
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

WineShop – Food & Wine Store WordPress Theme [wineshop]

Researcher

More Details >

WP File Download <= 6.3.9 – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via ‘task’ Parameter to Multiple Functions

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-94538
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WP File Download [wp-file-download]

Researcher

More Details >

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 – Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-104759
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]

Researcher

More Details >

Yacht Rental – Boat Services WordPress Theme <= 2.6 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62054
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Yacht Rental – Boat Services WordPress Theme [yacht-rental]

Researcher

More Details >

Angio <= 1.1.1 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-62021
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Angio – Creative Music Theme [angio]

Researcher

More Details >

Appointment Booking Plugin <= 5.7.2 – Unauthenticated SQL Injection via ‘booking[service_id]’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96662
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.8 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-42417
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup [armember]

Researcher

More Details >

ASPL Product Quotation <= 1.1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89287
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

ASPL Product Quotation [aspl-product-quotation]

Researcher

More Details >

Booknetic <= 4.8.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-39746
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Booknetic [booknetic]

Researcher

More Details >

ColorFolio <= 1.3 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94065
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

colorit [colorit]

Researcher

More Details >

Datalist it <= 0.0.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89285
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Datalist it [datalistit]

Researcher

More Details >

Directory Listings WordPress plugin – uListing <= 2.2.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-62031
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Directory Listings WordPress plugin – uListing [ulisting]

Researcher

More Details >

Divi Plus <= 2.4.0 – Unauthenticated Arbitrary File Read via ‘svg_image’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-91136
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Divi Plus [divi-plus]

Researcher

More Details >

Dynamic User Directory <= 2.4 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-42719
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Dynamic User Directory [dynamic-user-directory]

Researcher

More Details >

Gmedia Photo Gallery <= 1.25.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-39785
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Gmedia Photo Gallery [grand-media]

Researcher

More Details >

Llavero.io <= 0.1.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89213
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Llavero.io [llavero-io]

Researcher

More Details >

Loja Automática <= 1.0.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89297
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Loja Automática [loja-automatica]

Researcher

More Details >

LTL Freight Quotes – Old Dominion Edition 4.2.11 – 4.2.18 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87781
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]

Researcher

More Details >

Mobile Builder <= 1.4.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-103695
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Mobile builder [mobile-builder]

Researcher

More Details >

Music Store <= 1.4.7 – Unauthenticated Arbitrary File Read via ‘f’ Parameter

7.5

CVSS Rating
7.5 (High)
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Music Store – WordPress eCommerce [music-store]

Researcher

More Details >

Neo | Barber Shop WordPress <= 3.5 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94064
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Neo | Barber Shop WordPress Theme [neocut]

Researcher

More Details >

Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-41555
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Newsletter Subscription Form – User Subscriptions Form, Capture Email [newsletter-subscription-form]

Researcher

More Details >

Paymendo Bank Transfer <= 1.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89304
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]

Researcher

More Details >

Porto Theme – Functionality <= 3.9.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-42415
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Porto Theme – Functionality [porto-functionality]

Researcher

More Details >

Post Voting System <= 1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89302
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Post Voting System [post-voting-system]

Researcher

More Details >

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-104392
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

More Details >

Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.19 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-39764
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events [radius-booking]

Researcher

More Details >

RecordBrowser <= 1.1.7 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89232
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Recordbrowser [recordbrowser]

Researcher

More Details >

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 – Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via ‘files[tmp_name]’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89301
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

More Details >

SendPress Newsletters <= 1.26.1.20 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-39795
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

SendPress Newsletters [sendpress]

Researcher

More Details >

Site Setup Wizard <= 1.5.8 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89195
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Site Setup Wizard [site-setup-wizard]

Researcher

More Details >

Slider by 10Web – Responsive Image Slider <= 1.2.62 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-105885
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Slider by 10Web – Responsive Image Slider [slider-wd]

Researcher

More Details >

Social Web Suite <= 4.1.12 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-88930
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]

Researcher

More Details >

Tainacan <= 1.3.0 – Authenticated (Custom Role+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94676
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Tainacan [tainacan]

Researcher

More Details >

Tcard WP <= 1.8.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-81420
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Tcard WP [tcard-wp]

Researcher

More Details >

Testimonials by BestWebSoft 1.0.5 – 1.0.8 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89235
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Testimonials by BestWebSoft [bws-testimonials]

Researcher

More Details >

Tickera – Sell Tickets & Manage Events <= 3.6.0.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-105889
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

More Details >

Travel Booking WordPress Theme <= 3.2.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93947
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Travel Booking WordPress Theme [traveler]

Researcher

More Details >

Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 – Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-82627
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator]

Researcher

More Details >

Verify API <= 1.0.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89299
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

WP Verify API [wp-verify-api]

Researcher

More Details >

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 – Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via ’email’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93746
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce]

Researcher

More Details >

WP Rocket < 3.23.5 – Unauthenticated Denial of Service

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-97076
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WP Rocket [wp-rocket]

Researcher

More Details >

WP-Partner <= 1.2.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89234
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

WP-Partner [wp-partner]

Researcher

More Details >

WpCues Basic Quiz <= 1.6.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89214
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

WpCues Basic Quiz [wpcues-basic-quiz]

Researcher

More Details >

AI Content Generator Marketing <= 1.0.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-85118
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

AI Content Generator Marketing [ai-content-generator-marketing]

Researcher

More Details >

Doctreat Core <= 1.7.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-39773
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Doctreat Core [doctreat_core]

Researcher

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-96341
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Frontend Dashboard 3.0.0 – 3.0.4 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-103692
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Frontend Dashboard [frontend-dashboard]

Researcher

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-104405
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Meta Box AIO <= 3.7.1 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-39761
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Meta Box AIO [meta-box-aio]

Researcher

More Details >

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-106610
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]

Researcher

More Details >

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.7 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-105070
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]

Researcher

More Details >

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-95594
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]

Researcher

More Details >

SMS Alert 3.9.6 – 4.0.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-94257
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]

Researcher

More Details >

Taskbot <= 6.6 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-39753
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Taskbot [taskbot]

Researcher

More Details >

Ultimate Multisite <= 2.16.0 – Unauthenticated Arbitrary Account Takeover

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-103646
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform [ultimate-multisite]

Researcher

More Details >

10Web Booster <= 2.34.8 – Unauthenticated Stored Cross-Site Scripting via Comment Author Name

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-107742
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]

Researcher

More Details >

aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder <= 2.16.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-40804
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder [ablocks]

Researcher

More Details >

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-105318
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researcher

More Details >

Additional Order Filters for WooCommerce <= 1.24 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39800
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Additional Order Filters for WooCommerce [additional-order-filters-for-woocommerce]

Researcher

More Details >

Adwised Web Push Notification <= 2.5.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87762
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Adwised Web Push Notification [adwised]

Researchers

More Details >

Ansar Import – One Click Starter Sites – for WordPress Themes <= 2.1.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39778
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Ansar Import – One Click Starter Sites – for WordPress Themes [ansar-import]

Researcher

More Details >

ARforms <= 7.1.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39766
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

ARforms [arforms]

Researcher

More Details >

AWP Classifieds <= 4.4.8 – Authenticated (Administrator+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2025-15700
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

AWP Classifieds [another-wordpress-classifieds-plugin]

Researcher

More Details >

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-62116
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]

Researcher

More Details >

Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-62034
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]

Researcher

More Details >

Blog, Posts and Category Filter for Elementor <= 2.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-40806
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Blog, Posts and Category Filter for Elementor [blog-posts-and-category-for-elementor]

Researcher

More Details >

BuddyPress Instant Chat <= 1.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87764
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

BuddyPress Instant Chat [bp-instant-chat]

Researchers

More Details >

Builderius – Landing Page Builder + Dynamic Templates <= 1.4-beta – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-27350
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Builderius – Landing Page Builder + Dynamic Templates [builderius]

Researcher

More Details >

CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-40807
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

CF7 Views – Complete Entry Management for Contact Form 7 [cf7-views]

Researcher

More Details >

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104394
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) [charitable]

Researcher

More Details >

click5 CRM add-on to Contact Form 7 <= 1.0.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84261
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]

Researcher

More Details >

click5 CRM add-on to Gravity Forms <= 1.0.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84260
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]

Researcher

More Details >

click5 CRM add-on to Ninja Forms <= 1.0.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84258
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]

Researcher

More Details >

click5 CRM add-on to WPForms <= 1.0.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84259
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

click5 CRM add-on to WPForms [wpf-add-on-by-click5]

Researcher

More Details >

Coder 4.0 – 4.5.1 – Authenticated (Editor+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104677
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WP Coder – Insert & Manage Code Snippets [wp-coder]

Researcher

More Details >

Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress <= 1.7.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39745
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress [contact-form-to-db]

Researcher

More Details >

Database for CF7 <= 1.2.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39731
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Database for CF7 [database-for-cf7]

Researcher

More Details >

Document Embedder – let visitors read files without downloading <= 2.4.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-62037
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Document Embedder – let visitors read files without downloading [document-emberdder]

Researcher

More Details >

Document Gallery <= 5.1.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39781
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Document Gallery [document-gallery]

Researcher

More Details >

Easy Digital Downloads <= 3.6.9 – Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-14335
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researchers

More Details >

Educavo – Education WordPress Theme <= 3.4.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-78534
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Educavo – Education WordPress Theme [educavo]

Researcher

More Details >

Envira Gallery <= 1.16.1 – Authenticated (Admin+) Arbitrary Plugin Installation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104680
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Fastcache by Host.it <= 1.7.4 – Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via ‘cache_cookie_exclude’ Setting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104021
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Fastcache by Host.it [fastcache-by-host-it]

Researcher

More Details >

Fluent Forms Pro Add On Pack <= 6.2.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94675
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Fluent Forms Pro Add On Pack [fluentformpro]

Researcher

More Details >

Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42709
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Food Menu – Restaurant Menu & Online Ordering for WooCommerce [tlp-food-menu]

Researcher

More Details >

Form Block <= 1.8.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104814
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Form Block [form-block]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102388
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

FunnelKit <= 3.16.0.5 – Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-100147
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

FunnelKit – Funnel Builder Plugin for WooCommerce Checkout [funnel-builder]

Researcher

More Details >

FV Player 8 <= 8.1.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42699
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

FV Player 8 [fv-player]

Researcher

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104672
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-103309
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI [gptranslate]

Researcher

More Details >

HivePress <= 1.7.31 – Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-107657
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]

Researcher

More Details >

HootBoard <= 3.1.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-86798
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

HootBoard – Bulletin Board For Your Organization & Team Communication [hootboard]

Researchers

More Details >

Hotel Booking <= 3.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39784
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Hotel Booking [nd-booking]

Researcher

More Details >

HTTP Requests Manager <= 1.3.11 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39724
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

HTTP Requests Manager [http-requests-manager]

Researcher

More Details >

Instapage Plugin <= 3.7.2 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39728
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Instapage Plugin [instapage]

Researcher

More Details >

Jannah – Newspaper Magazine News BuddyPress AMP <= 7.6.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42693
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Jannah – Newspaper Magazine News BuddyPress AMP [jannah]

Researcher

More Details >

Jotform – AI Chatbot <= 3.8.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-40803
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Jotform – AI Chatbot [jotform-ai-chatbot]

Researcher

More Details >

KeyWord Collector <= 1.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88905
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

KeyWord Collector [keyword-collector]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 – Unauthenticated Stored Cross-Site Scripting via Registration Metadata

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102173
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

LazyLoad Plugin <= 2.4.0 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-100196
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

LazyLoad Plugin – Lazy Load Images, Videos, and Iframes [rocket-lazy-load]

Researcher

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104670
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LMS <= 8.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-78532
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

LMS – Education WordPress Theme [lms]

Researcher

More Details >

LTL Freight Quotes – Old Dominion Edition <= 4.2.18 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87780
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]

Researcher

More Details >

Mapster WP Maps <= 2.0.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39720
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Mapster WP Maps [mapster-wp-maps]

Researcher

More Details >

Midtrans-WooCommerce <= 2.32.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39758
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Midtrans-WooCommerce [midtrans-woocommerce]

Researcher

More Details >

Molongui Authorship <= 5.2.12 – Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-101920
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress [molongui-authorship]

Researcher

More Details >

Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 – Unauthenticated Stored Cross-Site Scripting via ‘content’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81929
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Ocean eComm Treasure Box [ocean-ecommerce]
Ocean Pro Demos [ocean-pro-demos]

Researchers

More Details >

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 – Unauthenticated Stored Cross-Site Scripting via ‘s’ Search Parameter in comments-atom Feed

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-89417
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. [host-webfonts-local]

Researcher

More Details >

Online Scheduling and Appointment Booking System <= 28.2 – Authenticated (Custom+) PHP Object Injection via ‘value’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-12626
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.47 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42715
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Photo Reviews for WooCommerce <= 1.2.30 – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘wcpr_image_upload_id’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-100161
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Photo Reviews for WooCommerce [woo-photo-reviews]

Researcher

More Details >

picu – Online Photo Proofing Gallery <= 3.10.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104395
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

picu – Online Photo Proofing Gallery [picu]

Researcher

More Details >

Piotnet Forms <= 1.0.30 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96227
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Piotnet Forms [piotnetforms]

Researcher

More Details >

Podlove Podcast Publisher <= 4.5.6 – Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93775
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]

Researcher

More Details >

Post Grid Gutenberg Blocks <= 5.1.0 – Unauthenticated Stored Cross-Site Scripting via display_name User Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96840
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Post Grid Gutenberg Blocks – PostX [ultimate-post]

Researcher

More Details >

Post SMTP <= 4.0.1 – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘user_email’ Parameter (Multisite Registration → Failed Email Log)

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-75962
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App [post-smtp]

Researcher

More Details >

Prenotazioni <= 1.7.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-103305
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Prenotazioni [prenotazioni]

Researchers

More Details >

Presto Player <= 4.5.1 – Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96682
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Presto Player [presto-player]

Researcher

More Details >

Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39726
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Product Designer for WooCommerce WordPress | Lumise [lumise]

Researcher

More Details >

Qode Music <= 2.1.8.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42631
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Qode Music [qode-music]

Researcher

More Details >

Qode Real Estate <= 1.1.7.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42632
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Qode Real Estate [qode-real-estate]

Researcher

More Details >

Quiz and Survey Master (QSM) <= 11.2.6 – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘qsm_hidden_questions’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96558
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

More Details >

Rank Math SEO <= 1.0.279 – Authenticated (Administrator+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-104752
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

More Details >

Real Estate Manager <= 7.3 – Unauthenticated Stored Cross-Site Scripting via ‘first_name’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96667
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Real Estate Manager – Property Listing and Agent Management [real-estate-manager]

Researcher

More Details >

Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39760
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]

Researcher

More Details >

Slider by 10Web – Responsive Image Slider <= 1.2.63 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42711
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Slider by 10Web – Responsive Image Slider [slider-wd]

Researcher

More Details >

SmugMug Embed <= 3.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88826
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

SmugMug Embed [smugmug-embed]

Researcher

More Details >

Social Rocket – Social Sharing Plugin <= 1.3.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42418
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Social Rocket – Social Sharing Plugin [social-rocket]

Researcher

More Details >

Social Share Icons & Social Share Buttons <= 3.7.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42697
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Social Share Icons & Social Share Buttons [ultimate-social-media-plus]

Researcher

More Details >

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.0.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39750
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

More Details >

StreamCast – bring live radio to your site with a sleek player <= 2.4.5 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-62030
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

StreamCast – bring live radio to your site with a sleek player [streamcast]

Researcher

More Details >

Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 – Authenticated (Editor+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39776
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]

Researcher

More Details >

Team Section Block – Showcase Team Members with Layout Options <= 2.0.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-62027
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Team Section Block – Showcase Team Members with Layout Options [team-section]

Researcher

More Details >

Topcontent <= 1.2.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88903
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Topcontent [topcontent]

Researcher

More Details >

Tutor LMS – eLearning and online course solution <= 4.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42702
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Video Background Block – Add Stunning Video Backgrounds to Any Section <= 2.0.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42634
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Video Background Block – Add Stunning Video Backgrounds to Any Section [video-background-block]

Researcher

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.15 – Unauthenticated Stored Cross-Site Scripting via ‘attachments[name]’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95684
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

VikRentCar Car Rental Management System <= 1.4.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39790
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

VikRentCar Car Rental Management System [vikrentcar]

Researcher

More Details >

Web Vitals Tracking <= 5.4.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87760
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Web Vitals Tracking [web-vitals-tracking]

Researchers

More Details >

WooCommerce Simple Auctions <= 3.0.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42635
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WooCommerce Simple Auctions [woocommerce-simple-auctions]

Researcher

More Details >

WordPress Core 7.1 – 7.1.2 – Unauthenticated Stored Cross-Site Scripting via Pending Comments

7.2

CVSS Rating
7.2 (High)
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP Associate Post R2 <= 5.0.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-105870
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WP Associate Post R2 [wp-associate-post-r2]

Researcher

More Details >

WP File Download <= 6.3.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39799
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

WP File Download [wp-file-download]

Researcher

More Details >

WP Mailster <= 1.9.0.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-105061
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WP Mailster [wp-mailster]

Researcher

b1c4c306fad16439d9178a0d349f0c40L4m

More Details >

WP Meteor Website Speed Optimization Addon <= 3.4.18 – Unauthenticated Stored Cross-Site Scripting via Comment Author Name

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96572
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WP Meteor Website Speed Optimization Addon [wp-meteor]

Researcher

More Details >

WP Photo Album Plus <= 9.3.03.002 – Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96278
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WPAdverts – Classifieds Plugin <= 2.3.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97263
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

More Details >

WPAdverts <= 2.3.4 – Unauthenticated Stored Cross-Site Scripting via ‘adverts_location’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-100178
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

More Details >

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42636
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 – Unauthenticated Stored Cross-Site Scripting via ‘id_token’ Parameter (iss / unique_name JWT claims)

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96765
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]

Researcher

More Details >

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39780
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress [youzify]

Researcher

More Details >

Online Scheduling and Appointment Booking System <= 28.4 – Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via ‘id’ and ‘wp_user_id’ Parameters via Query String / JSON Body

6.8

CVSS Rating
6.8 (Medium)
CVE-ID

CVE-2026-104898
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension

6.8

CVSS Rating
6.8 (Medium)
CVE-ID

CVE-2025-14123
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

More Details >

Product Configurator for WooCommerce <= 1.7.5 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-105872
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Product Configurator for WooCommerce [product-configurator-for-woocommerce]

Researcher

More Details >

Super Video player – Fully Customizable Video Player with Playlist <= 1.8.14 – Authenticated (Editor+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-62044
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Super Video player – Fully Customizable Video Player with Playlist [super-video-player]

Researcher

More Details >

WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-62130
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]

Researcher

More Details >

YITH WooCommerce Affiliates <= 3.31.0 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-106606
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

YITH WooCommerce Affiliates [yith-woocommerce-affiliates]

Researcher

More Details >

Academy LMS <= 4.0.3 – Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-104915
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

More Details >

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-62117
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]

Researcher

More Details >

Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-62098
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]

Researcher

More Details >

BuddyBoss Platform <= 3.1.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-39771
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

BuddyBoss Platform [buddyboss-platform]

Researcher

More Details >

ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-40800
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) [elex-bulk-edit-products-prices-attributes-for-woocommerce-basic]

Researcher

More Details >

Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-42633
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]

Researcher

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 – Authenticated (Custom Role+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-104408
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Image Optimizer, Resizer and CDN – Sirv <= 8.2.5 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-104389
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Image Optimizer, Resizer and CDN – Sirv [sirv]

Researcher

More Details >

Kirki <= 6.3.1 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-84220
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

ListingPro Plugin <= 2.9.12 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-42414
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

ListingPro Plugin [listingpro-plugin]

Researcher

More Details >

Name Directory <= 1.34.2 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-104397
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Name Directory [name-directory]

Researcher

More Details >

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-105317
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

More Details >

Paymendo Bank Transfer <= 1.1 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-89305
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]

Researcher

More Details >

Piotnet Addons For Elementor <= 7.1.71 – Authenticated (Contributor+) Arbitrary File Read

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-39754
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Piotnet Addons For Elementor [piotnet-addons-for-elementor]

Researcher

More Details >

Qode Tours <= 3.1.3.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-42712
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Qode Tours [qode-tours]

Researcher

More Details >

SiteOrigin Widgets Bundle <= 1.74.3 – Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode ‘value’ JSON Instance (design.colors LESS Variable)

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-97348
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

SiteOrigin Widgets Bundle [so-widgets-bundle]

Researcher

More Details >

Slider by 10Web – Responsive Image Slider <= 1.2.63 – Authenticated (Author+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-42710
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Slider by 10Web – Responsive Image Slider [slider-wd]

Researcher

More Details >

Thanko Thank You Page Customizer for WooCommerce <= 1.2.3 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-103071
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Thanko Thank You Page Customizer for WooCommerce [woo-thank-you-page-customizer]

Researcher

More Details >

uDesign | Multipurpose WordPress Theme <= 4.15.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-42416
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

uDesign | Multipurpose WordPress Theme [u-design-core]

Researcher

More Details >

Vitepos – Point of Sale (POS) for WooCommerce <= 3.6.1 – Authenticated (Custom Role+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-105076
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]

Researcher

More Details >

W3 Total Cache <= 2.10.5 – Authenticated (Author+) Path Traversal

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-107321
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

More Details >

Woffice CRM <= 5.4.35 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-39747
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Woffice CRM [woffice]

Researcher

More Details >

WP Booking System <= 2.1.0.1 – Authenticated (Subscriber+) SQL Injection via ‘current_month’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-107712
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WP Booking System – Booking Calendar [wp-booking-system]

Researcher

More Details >

WP Directory Kit <= 1.5.9 – Authenticated (Subscriber+) SQL Injection via ‘display_name’ Profile Field (Second-Order)

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-96653
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

More Details >

WP Post Author 4.0.0 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-108125
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]

Researcher

More Details >

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-25434
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]

Researcher

More Details >

WPBase Cache <= 5.5.6 – Authenticated (Subscriber+) Denial of Service

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-39767
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WPBase Cache [wpbase-cache]

Researcher

More Details >

Advanced Classifieds & Directory Pro <= 3.4.4 – Authenticated (Custom+) Stored Cross-Site Scripting via ‘phone’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-93883
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Advanced Classifieds & Directory Pro [advanced-classifieds-and-directory-pro]

Researcher

More Details >

Adwised Web Push Notification <= 2.5.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-87761
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Adwised Web Push Notification [adwised]

Researchers

More Details >

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘author_facebook’ User Profile Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97340
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Avada | Website Builder For WordPress & WooCommerce [Avada]

Researcher

More Details >

bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104400
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

bBlocks – Essential Gutenberg Blocks & Patterns Collection [b-blocks]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

Brizy <= 2.8.18 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘brizy-compiled-sections’ Post Meta

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14882
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Brizy – Page Builder [brizy]

Researcher

More Details >

Church Admin <= 5.1.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ’email’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94421
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Church Admin [church-admin]

Researcher

More Details >

Data Tables Generator by Supsystic <= 1.12.03 – Authenticated (Contributor+) Stored Cross-Site Scripting via Table ‘id’ HTML Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14877
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]

Researcher

More Details >

Data Tables Generator by Supsystic <= 1.15.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell ‘data’ Value via updateRows Action

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96648
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]

Researcher

More Details >

Download Manager <= 3.3.58 – Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9696
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Download Manager <= 3.3.71 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘regurl’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102401
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

eCommerce Product Catalog <= 3.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105056
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

eCommerce Product Catalog [ecommerce-product-catalog]

Researcher

More Details >

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105873
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

More Details >

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105871
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

More Details >

Email Marketing for WordPress and WooCommerce <= 1.0.10 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘data’ Parameter to /updateOptions REST Endpoint

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97396
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Email Marketing for WordPress and WooCommerce – Retainful [retainful]

Researcher

More Details >

Embed Any Document <= 2.7.13 – Authenticated (Contributor+) Stored Cross-Site Scripting via ’embeddoc’ Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-18558
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files [embed-any-document]

Researcher

More Details >

Envira Gallery <= 1.16.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104652
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Envira Gallery <= 1.16.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104653
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Front End PM <= 11.4.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-39788
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Front End PM [front-end-pm]

Researcher

More Details >

Frontend Admin by DynamiApps <= 3.28.36 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6243
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researcher

More Details >

FV Flowplayer Video Player <= 7.5.54.7212 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-42695
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

FV Flowplayer Video Player [fv-wordpress-flowplayer]

Researcher

More Details >

FV Flowplayer Video Player <= 7.5.54.7212 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97630
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

FV Flowplayer Video Player [fv-wordpress-flowplayer]

Researcher

More Details >

Gallery PhotoBlocks <= 1.3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-107323
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Gallery PhotoBlocks [photoblocks-grid-gallery]

Researcher

More Details >

GamiPress <= 7.9.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘video_id’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14379
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]

Researcher

More Details >

GeoDirectory <= 2.8.188 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104993
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

More Details >

Getwid <= 3.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘data-image-points’

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-91862
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Getwid – Gutenberg Blocks [getwid]

Researcher

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104404
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

GiveWP <= 4.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97643
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Graphene <= 2.9.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-17025
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Graphene [graphene]

Researcher

More Details >

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104393
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]

Researcher

More Details >

HivePress <= 1.7.31 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103520
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]

Researcher

More Details >

HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62039
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player [html5-audio-player]

Researcher

More Details >

Image Photo Gallery Final Tiles Grid <= 3.6.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104409
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]

Researcher

More Details >

Image Photo Gallery Final Tiles Grid <= 3.6.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104646
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]

Researcher

More Details >

Image Slider <= 1.1.130 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-42700
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Image Slider [image-slider-widget]

Researcher

More Details >

JetBlocks for Elementor <= 1.5.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62049
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

JetBlocks for Elementor [jet-blocks]

Researcher

More Details >

JetElements <= 2.9.2.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105879
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

JetElements [jet-elements]

Researcher

More Details >

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.12 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105890
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

More Details >

Kadence Blocks <= 3.7.12 – Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104762
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

More Details >

LazyLoad Plugin – Lazy Load Images, Videos, and Iframes <= 2.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105884
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

LazyLoad Plugin – Lazy Load Images, Videos, and Iframes [rocket-lazy-load]

Researcher

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 – Authenticated (Instructor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105397
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

Logo Showcase – Logo Slider, Carousel & Sponsors Gallery <= 4.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105060
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Logo Showcase – Logo Slider, Carousel & Sponsors Gallery [logo-showcase]

Researcher

More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.52 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105079
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

Media Library Assistant <= 3.41 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97294
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Motors <= 1.4.123 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘stm_f_s’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96563
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104673
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]

Researcher

More Details >

MP3 Audio Player <= 5.14.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-16776
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]

Researcher

More Details >

Name Directory <= 1.34.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104396
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Name Directory [name-directory]

Researcher

More Details >

PeproDev Ultimate Profile Solutions <= 8.2.36 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘button’ Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4791
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

PeproDev Ultimate Profile Solutions [peprodev-ups]

Researcher

More Details >

Post Snippets <= 4.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12980
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Post Snippets – Custom WordPress Code Snippets Customizer [post-snippets]

Researcher

More Details >

PowerPress 11.13.12 – 11.17.9 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97354
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

More Details >

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.109 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103084
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]

Researcher

More Details >

Premium Packages <= 7.2.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘checkout[billing][phone]’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103478
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

More Details >

Presto Player <= 4.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102914
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Presto Player [presto-player]

Researcher

More Details >

Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105875
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite]

Researcher

More Details >

QR Redirector <= 2.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105069
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

QR Redirector [qr-redirector]

Researcher

More Details >

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104391
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

More Details >

Robo Gallery – Photo & Image Slider <= 5.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105887
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

More Details >

Robo Gallery <= 5.2.5 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-81155
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

More Details >

Robo Gallery <= 5.2.5 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-81153
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

More Details >

Robo Gallery <= 5.2.5 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-81154
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

More Details >

Robo Gallery <= 5.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-81156
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

More Details >

RSS Aggregator by Feedzy <= 5.2.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-104735
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]

Researcher

More Details >

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103070
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]

Researcher

More Details >

Simple Membership <= 4.8.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103427
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

More Details >

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102393
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg [astra-sites]

Researcher

6a866ccafe0dbf0a35a5de5931f3d3bafcc

More Details >

SureDash <= 1.12.1 – Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image ‘alt’ Attribute in Community Post Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102774
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

More Details >

Table Field Add-on for ACF and SCF <= 1.3.35 – Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-78068
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]

Researcher

More Details >

Table Field Add-on for ACF and SCF <= 1.4.1-RC2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96743
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]

Researcher

More Details >

Team <= 6.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘ttp_filter_taxonomy’ Post Meta via [tlpteam] Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102402
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Team – Team Members Showcase Plugin [tlp-team]

Researcher

More Details >

User Frontend <= 4.3.12 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘wpuf_payment_method’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96574
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

More Details >

WC Fields Factory <= 4.1.12 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-39727
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WC Fields Factory [wc-fields-factory]

Researcher

More Details >

WordPress Core 4.7.0 – 7.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed

6.4

CVSS Rating
6.4 (Medium)
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researchers

More Details >

WP Plugin Info Card <= 6.3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62127
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WP Plugin Info Card [wp-plugin-info-card]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

WP Store Locator <= 3.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-105078
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WP Store Locator [wp-store-locator]

Researcher

More Details >

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62029
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

More Details >

Zotpress <= 7.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-27420
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Zotpress [zotpress]

Researcher

More Details >

AI Copilot – Content Generator <= 1.5.9 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-39801
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

AI Copilot – Content Generator [ai-copilot-content-generator]

Researcher

More Details >

FooSales <= 1.43.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-93548
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

FooSales – Point of Sale (POS) for WooCommerce [foosales]

Researcher

More Details >

JobZilla – Job Board WordPress Theme <= 2.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-39775
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

JobZilla – Job Board WordPress Theme [jobzilla]

Researcher

More Details >

Koinonia Link 1.1.2 – 1.1.4 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-87782
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Koinonia Link [koinonia-link]

Researcher

More Details >

Mobile builder <= 1.4.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-103694
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Mobile builder [mobile-builder]

Researcher

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 – Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-93509
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

More Details >

Wallet System for WooCommerce 2.0.0 – 2.7.10 – Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-93509
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

More Details >

WP User Profiles <= 2.7.3 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-105058
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WP User Profiles [wp-user-profiles]

Researcher

More Details >

Ambed <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-62064
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Ambed – Wallpapers & Painting Services WordPress Theme [ambed]

Researcher

More Details >

Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-62091
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) [armania]

Researcher

More Details >

Aurora Heatmap <= 1.7.2 – Unauthenticated Stored Cross-Site Scripting via ‘url’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94154
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Aurora Heatmap [aurora-heatmap]

Researcher

More Details >

Biolife – Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-62095
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Biolife – Organic Food WordPress Theme ( RTL Supported ) [biolife]

Researcher

More Details >

Download Manager <= 3.3.57 – Unauthenticated DOM-Based Reflected Cross-Site Scripting via ‘REFERRER’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-12054
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Education Center <= 3.6.12 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94063
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Education Center | LMS & Online Courses WordPress Theme [education]

Researcher

More Details >

EduMall – Professional LMS Education Center WordPress Theme <= 4.5.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-39748
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

EduMall – Professional LMS Education Center WordPress Theme [edumall]

Researcher

More Details >

Favicon Rotator <= 1.2.11 – Reflected Cross-Site Scripting via ‘fvrt_’ prefix

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-5725
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Favicon Rotator [favicon-rotator]

Researcher

More Details >

Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 – Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-87869
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Filter Everything — WordPress & WooCommerce Filters [filter-everything]

Researcher

More Details >

Form Maker by 10Web <= 1.15.48 – Reflected Cross-Site Scripting via ‘inputs’ Parameter Array Key

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-103998
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

More Details >

Gloria Admin Panel <= 1.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94158
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Gloria Admin Panel [gloria-admin-panel]

Researcher

More Details >

If-So Dynamic Content 1.4.4 – 1.10.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-87971
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]

Researcher

More Details >

Kids Planet – Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57742
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Kids Planet – Children Kindergarten and Playgroup WordPress Theme [kidsplanet]

Researcher

More Details >

KuteShop <= 4.2.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-62100
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

kuteshop [kuteshop]

Researcher

More Details >

Magee Shortcodes <= 2.1.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-105316
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Magee Shortcodes [magee-shortcodes]

Researchers

More Details >

Martfury – Marketplace Mobile App Figma Template <= 3.3.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57806
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Martfury – Marketplace Mobile App Figma Template [martfury]

Researcher

More Details >

Ogency <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94059
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Ogency – Web Design Agency WordPress Theme [ogency]

Researcher

More Details >

Payment Plugins for Stripe WooCommerce <= 4.0.17 – Reflected DOM-Based Cross-Site Scripting via ‘#response’ URL Fragment

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-89100
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Payment Plugins for Stripe WooCommerce [woo-stripe-payment]

Researcher

More Details >

Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission <= 7.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-62082
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission [pin-wp]

Researcher

More Details >

Subscribe to Comments <= 2.3.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-91829
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Subscribe to Comments [subscribe-to-comments]

Researcher

More Details >

TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-62093
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) [techone]

Researcher

More Details >

ThemeStek Extras for LabtechCO Theme <= 8.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94160
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

ThemeStek Extras for LabtechCO Theme [themestek-labtechco-extras]

Researcher

More Details >

Treck <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94058
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Treck – Immigration and Visa Consulting WordPress Theme [treck]

Researcher

More Details >

Voldor <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94060
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Voldor – Welding & Metal Work WordPress Theme [voldor]

Researcher

More Details >

Whistle – Sports Club <= 4.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94061
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Whistle – Sports Clothing & Fitness Equipment [whistle-sports-club]

Researcher

More Details >

WPAdverts – Classifieds Plugin <= 2.3.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-97264
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

More Details >

WPLMS Learning Management System for WordPress, WordPress LMS <= 4.972 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-39722
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WPLMS Learning Management System for WordPress, WordPress LMS [wplms]

Researcher

More Details >

Zeinet <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-93951
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Zeinet – Internet Provider & Satellite TV [zeinet]

Researcher

More Details >

Kirki <= 6.3.1 – Authenticated (Editor+) Server-Side Request Forgery

5.5

CVSS Rating
5.5 (Medium)
CVE-ID

CVE-2026-84224
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Academy LMS <= 4.0.3 – Authenticated (Custom+) Privilege Escalation to add_child REST endpoint

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-104022
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

More Details >

Anti-Spam by CleanTalk <= 6.88 – Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-103424
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Spam Protection for Forms & Comments. Anti-Spam by CleanTalk [cleantalk-spam-protect]

Researcher

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-17538
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

Fluent Forms <= 6.2.5 – Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-15178
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

More Details >

Hello Plus <= 1.7.7 – Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-5727
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Hello Plus [hello-plus]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘display_name’

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-102291
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Simple Newsletter Plugin <= 4.3.10 – Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-103482
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Noptin – Newsletter, New Post Notifications & Email Automation [newsletter-optin-box]

Researcher

More Details >

10WebSocial <= 1.4.35 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39787
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

10WebSocial [wd-instagram-feed]

Researcher

More Details >

Accept PayPal Payments using Contact Form 7 <= 4.0.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105989
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]

Researcher

More Details >

Accept PayPal Payments Using Contact Form 7 <= 4.0.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105990
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]

Researchers

More Details >

Advanced Google reCAPTCHA <= 5.40 – Unauthenticated Login Protection Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-100518
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Advanced Google reCAPTCHA [advanced-google-recaptcha]

Researcher

More Details >

Advanced Posts Listing – Show Post List Easily <= 1.0.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39796
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Advanced Posts Listing – Show Post List Easily [advanced-posts-listing]

Researcher

More Details >

Airwallex Online Payments Gateway <= 1.35.0 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103517
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Airwallex Online Payments Gateway [airwallex-online-payments-gateway]

Researcher

More Details >

Appointment Booking Calendar <= 1.6.11.11 – Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6723
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105198
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.7 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39756
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Appointment Bookings for Zoom GoogleMeet and more – Wappointment [wappointment]

Researcher

More Details >

Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39762
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Autoship Cloud for WooCommerce Subscription Products [autoship-cloud]

Researcher

More Details >

BackWPup – WordPress Backup & Restore Plugin < 5.7.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86826
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

More Details >

BackWPup – WordPress Backup & Restore Plugin 3.3 – 5.7.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86827
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

More Details >

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62118
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]

Researcher

More Details >

Bayarcash WooCommerce <= 4.4.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-106609
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Bayarcash WooCommerce [bayarcash-wc]

Researcher

More Details >

Booking Calendar < 11.8 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105193
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Booking Calendar <= 11.4.3 – Unauthenticated Sensitive Information Exposure in ‘WPBC_FLEXTIMELINE_NAV’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-18496
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Booking Package <= 1.7.29 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105995
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Booking Package [booking-package]

Researcher

More Details >

Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms <= 5.2.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39772
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms [captcha-bws]

Researcher

More Details >

click5 CRM add-on to Contact Form 7 <= 1.0.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84254
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]

Researcher

More Details >

click5 CRM add-on to Gravity Forms <= 1.0.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84253
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]

Researcher

More Details >

click5 CRM add-on to Ninja Forms <= 1.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84251
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]

Researcher

More Details >

click5 CRM add-on to WPForms <= 1.0.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84252
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

click5 CRM add-on to WPForms [wpf-add-on-by-click5]

Researcher

More Details >

Contest Gallery <= 33.0.0 – Unauthenticated Unauthorized Account Activation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-107120
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

More Details >

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62128
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms]

Researcher

More Details >

CURCY – Multi Currency for WooCommerce <= 2.2.17 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97071
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

CURCY – Multi Currency for WooCommerce [woo-multi-currency]

Researcher

1e008e2827556f92e4e1199ee59c1c4ddcs

More Details >

CV Builder – Professional Resume Builder SaaS <= 1.3.1 – Missing Authorization to Unauthenticated PNG File Upload

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-3717
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WP CV Builder [cv-builder]

Researcher

More Details >

DK <= 3.2.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42706
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

DK [dk]

Researcher

More Details >

DTX – Dynamic Text Extension for Contact Form 7 <= 5.0.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62043
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

DTX – Dynamic Text Extension for Contact Form 7 [contact-form-7-dynamic-text-extension]

Researcher

More Details >

E-cab Taxi Booking Manager for Woocommerce <= 2.1.1 – Missing Authroization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103351
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]

Researcher

More Details >

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42638
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

More Details >

Easy Digital Downloads <= 3.7.0 – Unauthenticated Unauthorized Account Creation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105190
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

More Details >

Edwiser Bridge – WordPress Moodle Integration <= 4.3.4 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39729
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Edwiser Bridge – WordPress Moodle Integration [edwiser-bridge]

Researcher

More Details >

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62038
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]

Researcher

More Details >

Event Tickets and Registration <= 5.30.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105893
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97300
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103684
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105073
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105068
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]

Researcher

More Details >

FireBox <= 3.1.13 – Authenticated (Author+) SQL Injection via FireBox Form Display Condition

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104724
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment [firebox]

Researcher

More Details >

Fluent Affiliate Pro <= 1.6.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39789
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Fluent Affiliate Pro [fluent-affiliate-pro]

Researcher

More Details >

Fluent Booking Pro < 2.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105072
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Fluent Booking Pro [fluent-booking-pro]

Researcher

More Details >

Fluent Forms Pro Add On Pack <= 6.2.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94669
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Fluent Forms Pro Add On Pack [fluentformpro]

Researcher

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-65459
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Fundiin <= 3.4.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81649
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Fundiin cho WooCommerce [fundiin]

Researcher(s): Unknown

More Details >

Geliver Akıllı Kargo Pazaryeri 3.0.0 – 3.1.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103378
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Geliver Akıllı Kargo Pazaryeri [geliver-akilli-kargo-pazaryeri]

Researcher

More Details >

GIFT4U – Gift Cards All in One for Woo <= 1.1.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103357
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]

Researcher

1e008e2827556f92e4e1199ee59c1c4ddcs

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-106600
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Grand News <= 3.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42705
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

grandnews [grandnews]

Researcher

More Details >

Graphina – Charts and Graphs For Elementor <= 3.1.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39769
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]

Researcher

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104385
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.14 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-106603
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

HollerBox — Fast & Effective Popups & Lead-Generation [holler-box]

Researcher

More Details >

Insurify <= 1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86717
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Insurify – Order & Shipping Protection [insurify]

Researcher

More Details >

Insurify <= 1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85121
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Insurify – Order & Shipping Protection [insurify]

Researcher

More Details >

Integration for Epos Now and WooCommerce 4.6.0 – 4.11.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103323
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Integration for Epos Now and WooCommerce [woo-epos-now-integration]

Researcher

More Details >

Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-106601
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Jetpack – WP Security, Backup, Speed, & Growth [jetpack]

Researcher

More Details >

Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-106602
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Jetpack – WP Security, Backup, Speed, & Growth [jetpack]

Researcher

More Details >

Kit (formerly ConvertKit) for WooCommerce <= 2.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105421
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Kit (formerly ConvertKit) for WooCommerce [convertkit-for-woocommerce]

Researcher

More Details >

Livees Checkout 6.8 – 7.0.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86851
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Livees Checkout [livees-checkout]

Researcher

More Details >

Login Lockdown & Protection <= 2.17 – Unauthenticated Login Lockout Protection Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97308
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Login Lockdown & Protection [login-lockdown]

Researcher

More Details >

Magee Shortcodes <= 2.1.1 – Unauthenticated Mail Relay

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105322
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Magee Shortcodes [magee-shortcodes]

Researcher

More Details >

Mailjet Email Marketing <= 6.2.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39791
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Mailjet Email Marketing [mailjet-for-wordpress]

Researcher

More Details >

Modula Image Gallery – Photo Grid & Video Gallery <= 3.0.11 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105876
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]

Researcher

More Details >

Morning for WooCommerce <= 2.4.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39723
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Morning for WooCommerce [wc-gateway-greeninvoice]

Researcher

More Details >

Motors – Car Dealer, Rental & Listing WordPress theme <= 1.4.108 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-93950
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Motors – Car Dealer, Rental & Listing WordPress theme [motors]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin <= 1.4.124 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104399
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Museder RestoreOne <= 2.7.276 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-41561
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Museder RestoreOne [museder-restoreone]

Researcher

More Details >

Nexi XPay Build 7.0.0 – 7.6.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82211
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Nexi XPay Build [nexi-xpay-build]

Researcher

More Details >

Nexi XPay Build 7.2.2 – 7.6.2 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82212
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Nexi XPay Build [nexi-xpay-build]

Researchers

More Details >

Norvis Backup <= 1.1.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-41562
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Norvis Backup [norvis-backup]

Researcher

More Details >

Online Scheduling and Appointment Booking System <= 28.4 – Unauthenticated Sensitive Information Exposure in ‘phone’ Parameter to bookly_render_details

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103365
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

f24946464cb425a0ff53578166db2925R3D

More Details >

Order Export & Order Import for WooCommerce <= 2.7.8 – Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94375
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Order Export & Order Import for WooCommerce [order-import-export-for-woocommerce]

Researcher

More Details >

Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 – Unauthenticated Arbitrary Order Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-107420
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway [cryptocurrency-payments-using-metamask-for-woocommerce]

Researcher

More Details >

PayPlug for WooCommerce (Official) <= 3.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39751
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

PayPlug for WooCommerce (Official) [payplug]

Researcher

More Details >

PayPlug for WooCommerce (Official) <= 3.1.0 – Missing Authorization to Unauthenticated Settings Change

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42637
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

PayPlug for WooCommerce (Official) [payplug]

Researcher

More Details >

picu – Online Photo Proofing Gallery <= 3.10.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104406
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

picu – Online Photo Proofing Gallery [picu]

Researcher

More Details >

Posts Password Batch Manager <= 1.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89283
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

WP Posts Password Batch Manager [wp-posts-password-batch-manager]

Researcher

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.17.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104387
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.17.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104388
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

More Details >

Quick quotes <= 1.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86706
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Quick quotes – WPSHARE247 [quick-quotes-wpshare247]

Researcher

More Details >

Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62040
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Restrict User Access – Ultimate Membership & Content Protection [restrict-user-access]

Researcher

More Details >

SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-41559
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

SafeSnap – Verified WordPress Backup & Restore [safesnap]

Researcher

More Details >

Scripts n Styles <= 3.5.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62042
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Scripts n Styles [scripts-n-styles]

Researcher

More Details >

Sell Downloads <= 1.2.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94590
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Sell Downloads [sell-downloads]

Researcher

More Details >

SendPress <= 1.26.1.20 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92990
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

SendPress Newsletters [sendpress]

Researcher

More Details >

Shipping for Nova Poshta 1.18.7 – 1.19.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87846
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Shipping for Nova Poshta [nova-poshta-ttn]

Researcher

More Details >

Sitemovr <= 1.0.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-41563
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Sitemovr [sitemovr]

Researcher

More Details >

SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105071
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

SiteVault – Backup, Restore, Migration & Cloning [sitevault-backup-restore-migration]

Researcher

More Details >

SKU Error Fixer for WooCommerce <= 1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86850
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

SKU Error Fixer for WooCommerce [sku-error-fixer-for-woocommerce]

Researcher

More Details >

Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42413
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Snapshotify – All-in-One Backup & Restore & Migrate [snapshotify]

Researcher

More Details >

Social Web Suite <= 4.1.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88931
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]

Researcher

More Details >

Super Payments <= 1.43.0 – Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Forgery

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103329
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Super Payments – WooCommerce Payment Gateway [super-payments]

Researcher

More Details >

Swish Migrate and Backup <= 1.4.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42419
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Swish Migrate and Backup [swish-migrate-and-backup]

Researcher

More Details >

The7 — Website and eCommerce Builder for WordPress <= 14.2.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66588
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

The7 — Website and eCommerce Builder for WordPress [dt-the7]

Researcher

More Details >

Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping < 1.2.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94275
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping [track-orders-for-woocommerce]

Researcher

More Details >

TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 – Missing Authorization to Unauthenticated Settings Update

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39798
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

More Details >

TutorStarter <= 4.0.3 – Unauthenticated Unauthorized User Account Creation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104671
Patch Status

Patched
Published
Oct 6, 2026

Affected Software

TutorStarter [tutorstarter]

Researcher

More Details >

UnitechPay <= 1.0.6.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87841
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

UnitechPay – Wave & Orange Money Payments [unitechpay-paiements-mobile-money]

Researcher

More Details >

WCFM – Multivendor Marketplace REST API for WooCommerce <= 1.6.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39794
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WCFM – Multivendor Marketplace REST API for WooCommerce [wcfm-marketplace-rest-api]

Researcher

More Details >

Web Plura Backup & Restore – Local Backups, Restore & Recovery <= 0.2.25 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42630
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Web Plura Backup & Restore – Local Backups, Restore & Recovery [web-plura-backup-restore-manager]

Researcher

More Details >

WeddingCity Lite <= 1.0.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-106029
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

WeddingCity Lite – Wedding Directory and Listing [weddingcity-lite]

Researcher

More Details >

WooCommerce Bookings <= 3.10.0 – Unauthenticated Denial of Service

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-14854
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WooCommerce Bookings [woocommerce-bookings]

Researcher

More Details >

WordPress Core 4.7.0 – 7.1.2 – Unauthenticated Sensitive Information Exposure via Comment Feeds

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66666
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP Rentals – Booking Accommodation WordPress Theme <= 3.14.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27434
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

WP Rentals – Booking Accommodation WordPress Theme [wprentals]

Researcher

More Details >

WP Rocket < 3.23.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97075
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WP Rocket [wp-rocket]

Researcher

More Details >

WP Rollback – Rollback Plugins and Themes <= 3.1.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66435
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WP Rollback – Rollback Plugins and Themes [wp-rollback]

Researcher

More Details >

WPCafe <= 3.0.20 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86816
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

More Details >

WXD Backup Lite <= 1.0.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-41560
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WXD Backup Lite [wxd-backup-lite]

Researcher

More Details >

XServer Migrator <= 1.6.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-102387
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

XServer Migrator [xserver-migrator]

Researcher

More Details >

YITH WooCommerce Product Add-Ons <= 4.34.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66480
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

YITH WooCommerce Product Add-Ons [yith-woocommerce-product-add-ons]

Researcher

More Details >

YITH WooCommerce Product Bundles <= 2.29.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105878
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

YITH WooCommerce Product Bundles [yith-woocommerce-product-bundles]

Researcher

More Details >

Zero Spam for WordPress <= 5.7.11 – Unauthenticated Spam Protection Bypass on Login

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-105057
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Zero Spam for WordPress [zero-spam]

Researcher

More Details >

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-42721
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]

Researcher

More Details >

Animated Number Counters <= 3.0 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-104667
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Animated Number Counters [animated-number-counters]

Researcher

More Details >

BackWPup – WordPress Backup & Restore Plugin < 5.7.7 – Authenticated (Administrator+) Path Traversal

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-86828
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

More Details >

Code Snippets <= 3.9.0 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-106097
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Code Snippets [code-snippets]

Researcher

More Details >

Dynamic User Directory <= 2.4 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-42720
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Dynamic User Directory [dynamic-user-directory]

Researcher

More Details >

Frontend Admin by DynamiApps <= 3.29.13 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-42722
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researcher

More Details >

Leyka <= 3.32.3 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-42717
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Leyka [leyka]

Researcher

More Details >

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 – Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via ‘ix[file]’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-104722
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom]

Researcher

More Details >

MPG <= 4.2.2 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-104953
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]

Researcher

More Details >

Pix por Piggly (para Woocommerce) <= 2.1.2 – Authenticated (Shop Manager+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-42714
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Pix por Piggly (para Woocommerce) [pix-por-piggly]

Researcher

More Details >

Post Export Import with Media <= 1.17.1 – Authenticated (Administrator+) Path Traversal to Arbitrary File Read via ‘file_path’ Parameter in media_metadata.json

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-104763
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Post Export Import with Media [post-export-import-with-media]

Researcher

More Details >

Post title marquee scroll <= 9.9 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-42713
Patch Status

Unpatched
Published
Oct 7, 2026

Affected Software

Post title marquee scroll [post-title-marquee-scroll]

Researcher

More Details >

Rank Math SEO <= 1.0.279 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-104753
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

More Details >

Smart Popup by Supsystic <= 1.13.2 – Authenticated (Administrator+) SQL Injection via ‘sidx’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-104023
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Smart Popup by Supsystic [popup-by-supsystic]

Researcher

More Details >

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 4.0.0 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-42708
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]

Researcher

More Details >

WP Post Author <= 4.0.0 – Authenticated (Admin+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-108124
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]

Researcher

More Details >

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.2 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-45440
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]

Researcher

More Details >

WordPress Core 6.5.0 – 7.1.2 – Authenticated (Author+) Second-Order SQL Injection via WXR Export

4.8

CVSS Rating
4.8 (Medium)
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

Fluent Forms <= 6.2.14 – Reflected Cross-Site Scripting via ‘{get.*}’ Editor SmartCode Parameter

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-101324
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

More Details >

Import and export users and customers <= 2.5.5 – Authenticated (Editor+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-104757
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

JetFormBuilder <= 3.6.6 – Reflected DOM-Based Cross-Site Scripting via ‘query_var’ Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-103912
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

PDF Invoices & Packing Slips for WooCommerce – Challan <= 3.7.88 – Authenticated (Shop Manager+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-39765
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

PDF Invoices & Packing Slips for WooCommerce – Challan [webappick-pdf-invoice-for-woocommerce]

Researcher

More Details >

WooCommerce 9.8.0 – 11.1.2 – Authenticated (Shop Manager+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-106608
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WooCommerce [woocommerce]

Researcher

More Details >

WPForms <= 2.0.2.1 – Reflected Cross-Site Scripting via ‘query_var’ Smart Tag in iframe srcdoc Attribute

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-101921
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

Job Openings <= 3.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2025-15703
Patch Status

Patched
Published
Oct 10, 2026

Affected Software

HireZoot – Job Listings, Career Page & Recruitment Tool [wp-job-openings]

Researcher

More Details >

Rank Math SEO <= 1.0.279 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-104754
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

More Details >

Responsive Lightbox & Gallery <= 2.7.9 – Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content ‘title’ Attribute

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-103897
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Responsive Lightbox & Gallery [responsive-lightbox]

Researcher

More Details >

Academy LMS <= 3.0.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104050
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

More Details >

Academy LMS <= 3.0.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104049
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

More Details >

ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103685
Patch Status

Patched
Published
Oct 10, 2026

Affected Software

ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce [woo-alidropship]

Researcher

More Details >

All Bootstrap Blocks <= 1.3.31 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62036
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

All Bootstrap Blocks [all-bootstrap-blocks]

Researcher

73f53dafd32993ac7c0157a4e6729638Bao

More Details >

App for Cloudflare® <= 1.10.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39749
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

App for Cloudflare® [app-for-cf]

Researcher

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 – Authenticated (Custom Role+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105197
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.9 – Authenticated (Custom Role+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105196
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

Appointment Booking Plugin <= 5.7.2 – Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via ‘params[presets][order_item_id]’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91050
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

Asgaros Forum <= 3.4.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39779
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Asgaros Forum [asgaros-forum]

Researcher

More Details >

AutomatorWP <= 5.8.4 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104728
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI [automatorwp]

Researcher

More Details >

AutoPoly – AI Translation For Polylang <= 1.6.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-107419
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

AutoPoly – AI Translation For Polylang [automatic-translations-for-polylang]

Researcher

More Details >

Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62028
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]

Researcher

More Details >

Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104390
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Booktics – Appointment Booking Calendar for Service Businesses [booktics]

Researcher

More Details >

Comment Cleaner 6.1 – 7.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-107791
Patch Status

Patched
Published
Oct 10, 2026

Affected Software

WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments [delete-all-comments-of-website]

Researcher

More Details >

CP Media Player <= 1.3.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104678
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

CP Media Player – Audio Player and Video Player [audio-and-video-player]

Researcher

More Details >

Dashboard Notes <= 1.0.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62026
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Dashboard Notes [dashboard-notes]

Researcher

More Details >

Database Addon For WPForms ( wpforms entries ) – WPFormsDB < 1.1.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105260
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Database Addon For WPForms ( wpforms entries ) – WPFormsDB [database-for-wpforms]

Researcher

More Details >

Directory Listings WordPress plugin – uListing <= 2.2.0 – Missing Authorization to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62033
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Directory Listings WordPress plugin – uListing [ulisting]

Researcher

More Details >

Disable Users <= 1.0.5 – Disabled Account Authorization Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88827
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Disable Users [disable-users]

Researcher

More Details >

Dokan <= 5.1.0 – Authenticated (Vendor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-107694
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

Download Manager <= 3.3.71 – Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in ‘first_name’ Profile Field Token Injection into Suspension Email

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103964
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105194
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

More Details >

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.16.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104079
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Envira Gallery <= 1.16.1 – Authenticated (Author+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104681
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Envira Gallery <= 1.16.1 – Authenticated (Author+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104684
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Envira Gallery <= 1.16.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104682
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Event Tickets and Registration <= 5.30.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104675
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Event Tickets and Registration <= 5.30.0.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105891
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Event Tickets and Registration <= 5.30.0.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105888
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-106611
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Frontend Dashboard <= 2.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103681
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Frontend Dashboard [frontend-dashboard]

Researcher

More Details >

GDPR Data Request Form 1.5 – 1.7.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85348
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

GDPR Data Request Form [gdpr-data-request-form]

Researcher

More Details >

Grocery Shopping Store <= 1.3.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93949
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Grocery Shopping Store [grocery-shopping-store]

Researcher

More Details >

Hotel Booking <= 3.8 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84167
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Hotel Booking [nd-booking]

Researcher

More Details >

Hotel Booking <= 3.8 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84166
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Hotel Booking [nd-booking]

Researcher

More Details >

Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103075
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]

Researcher

More Details >

Image Photo Gallery Final Tiles Grid < 3.6.14 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104645
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]

Researcher

More Details >

Jetpack VideoPress <= 3.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-40808
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Jetpack VideoPress [jetpack-videopress]

Researcher

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103078
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103079
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

More Details >

Memberful – Membership Plugin <= 1.81.2 – Authenticated (Contributor+) Protected Post Content Disclosure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104401
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Memberful – Membership Plugin [memberful-wp]

Researcher

More Details >

MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.9 – Authenticated (Subscriber+) Payment Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-107434
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet [paid-membership]

Researcher

More Details >

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.19 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-108695
Patch Status

Unpatched
Published
Oct 10, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

More Details >

Optimole 4.0.0 – 4.2.14 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96530
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

More Details >

Polylang <= 3.8.7 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39783
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Polylang [polylang]

Researcher

More Details >

Portfolio Filter Gallery <= 2.2.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105976
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Portfolio Filter Gallery – Photo Gallery [portfolio-filter-gallery]

Researcher

More Details >

Portfolio Filter Gallery 2.0.2 – 2.2.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105977
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Portfolio Filter Gallery – Photo Gallery [portfolio-filter-gallery]

Researcher

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.17.9 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104407
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

More Details >

Pubjet <= 5.4.8 – Missing Authorization to Authenticated (Subscriber+) Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-40802
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Pubjet | پاب‌جت [pubjet]

Researcher

More Details >

QA Assistants – Driven by data <= 5.3.0.0 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105877
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

QA Assistants – Driven by data [qa-heatmap-analytics]

Researcher

More Details >

SendPress Newsletters <= 1.26.1.20 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92989
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

SendPress Newsletters [sendpress]

Researcher

More Details >

Simple JWT Login – Allows you to use JWT on REST endpoints. 4.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39793
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login]

Researcher

More Details >

Simple User Registration <= 6.9 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94235
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

MemberHero – Simple User Registration & Login [wp-registration]

Researcher

More Details >

Squadeno <= 1.11.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-107507
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Squadeno – Club Sports Manager [squadeno-club-sports-manager]

Researcher

More Details >

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39721
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg [astra-sites]

Researcher

More Details >

Th Shop Mania <= 1.9.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105883
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Th Shop Mania [th-shop-mania]

Researcher

More Details >

Tutor LMS – eLearning and online course solution <= 4.1.2 – Authenticated (Subscriber+) Race Condition

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-42698
Patch Status

Unpatched
Published
Oct 8, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Tutor LMS 4.0.5 – 4.1.0 – Authenticated (Instructor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85571
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets <= 4.5.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105886
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets [ultimate-post-kit]

Researcher

More Details >

Unlimited Elements for Elementor <= 2.0.22 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105064
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration <= 3.1.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62035
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration [upcasted-s3-offload]

Researcher

More Details >

User Private Files <= 2.1.8 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97331
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

User Private Files – Secure File Sharing and Client Portal Plugin [user-private-files]

Researcher

More Details >

Video Conferencing with Zoom <= 4.6.10 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103335
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Video Conferencing with Zoom [video-conferencing-with-zoom-api]

Researcher

More Details >

VillaTheme Core <= 1.0.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103072
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

VillaTheme Core [villatheme-core]

Researcher

More Details >

Visual Composer Website Builder <= 45.16.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-106596
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Visual Composer Website Builder [visualcomposer]

Researcher

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94245
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94246
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94244
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

More Details >

Wise Chat <= 3.4.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39730
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Wise Chat [wise-chat]

Researcher

More Details >

Wordable – Export Google Docs to WordPress <= 8.2.10 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-40801
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

Wordable – Export Google Docs to WordPress [wordable]

Researcher

More Details >

WordPress Core 4.7.0 – 7.1.2 – Authenticated (Author+) Unauthorized Sticky Post Modification via REST API

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core 4.7.0 – 7.1.2 – Authenticated (Contributor+) Denial of Service via Block Editor URL Details

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP 2FA – Two-factor authentication for WordPress <= 4.1.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62142
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WP 2FA – Two-factor authentication for WordPress [wp-2fa]

Researcher

More Details >

WP Admin Audit <= 1.2.17 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105062
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WP Admin Audit [wp-admin-audit]

Researcher

More Details >

WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments <= 7.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105059
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments [delete-all-comments-of-website]

Researcher

More Details >

WP Dummy Content Generator <= 4.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39763
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WP Dummy Content Generator [wp-dummy-content-generator]

Researcher

More Details >

WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62041
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce [wp-event-manager]

Researcher

More Details >

WP Mailster <= 1.9.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-105055
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WP Mailster [wp-mailster]

Researcher

More Details >

WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 – 2-Factor Authentication Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-41558
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WP Synchro – The Ultimate WordPress Migration Tool [wpsynchro]

Researcher

More Details >

WP-Invoice <= 4.3.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97183
Patch Status

Unpatched
Published
Oct 9, 2026

Affected Software

WP-Invoice – Web Invoice and Billing [wp-invoice]

Researcher

More Details >

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-25433
Patch Status

Unpatched
Published
Oct 5, 2026

Affected Software

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]

Researcher

More Details >

WPComplete <= 2.9.5.6 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-66479
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

WPComplete [wpcomplete]

Researcher

More Details >

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-102915
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]

Researcher

More Details >

wpsection <= 1.5.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-40777
Patch Status

Unpatched
Published
Oct 6, 2026

Affected Software

wpsection [wpsection]

Researcher

More Details >

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress <= 9.1.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104386
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]

Researcher

More Details >

Yaad Sarig Payment Gateway For WC <= 2.2.12 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104651
Patch Status

Patched
Published
Oct 5, 2026

Affected Software

Yaad Sarig Payment Gateway For WC [yaad-sarig-payment-gateway-for-wc]

Researcher

More Details >

SpeedyCache <= 1.4.2 – Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check

3.7

CVSS Rating
3.7 (Low)
CVE-ID

CVE-2026-104006
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

SpeedyCache – Cache, Optimization, Performance [speedycache]

Researcher

More Details >

WordPress Core 4.7.0 – 7.1.2 – Conditional Action Hook Injection via Unregistered Post Status or Post Type

3.3

CVSS Rating
3.3 (Low)
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

AI Puffer <= 2.4.89 – Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint

3.1

CVSS Rating
3.1 (Low)
CVE-ID

CVE-2026-104741
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

AI Puffer – MCP, AI Chatbot & Content Automation [gpt3-ai-content-generator]

Researcher

More Details >

AI Puffer <= 2.4.89 – Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action

3.1

CVSS Rating
3.1 (Low)
CVE-ID

CVE-2026-104742
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

AI Puffer – MCP, AI Chatbot & Content Automation [gpt3-ai-content-generator]

Researcher

More Details >

Simple Membership <= 4.8.2 – Information Exposure

3.1

CVSS Rating
3.1 (Low)
CVE-ID

CVE-2026-88785
Patch Status

Patched
Published
Oct 9, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

More Details >

Booking Calendar 10.15 – 11.8.2 – Authenticated (Editor+) Information Exposure

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-105195
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Code Snippets <= 3.9.0 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-106095
Patch Status

Patched
Published
Oct 7, 2026

Affected Software

Code Snippets [code-snippets]

Researcher

More Details >

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 – 4.0.0 – Authenticated (Administrator+) Information Exposure

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-94258
Patch Status

Patched
Published
Oct 8, 2026

Affected Software

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026) appeared first on Wordfence.

]]> 600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin https://swiftupdates.ca/600000-wordpress-sites-affected-by-sql-injection-vulnerability-in-backuply-wordpress-plugin/ Thu, 15 Oct 2026 15:40:20 +0000 https://swiftupdates.ca/600000-wordpress-sites-affected-by-sql-injection-vulnerability-in-backuply-wordpress-plugin/ On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a malicious SQL payload that is executed when an administrator later restores a database backup, ultimately allowing the attacker to escalate their privileges to administrator and take over the site.

Props to daroo who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,352.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Backuply, hosted on WordPress.org, on September 24, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on October 24, 2026.

We disclosed this vulnerability to the Backuply team on September 28, 2026, and the developer released the fully patched version on October 1, 2026. We would like to commend the Backuply team for their prompt response and timely patch.

We urge users to update their sites to the latest patched version of Backuply, version 1.5.9 at the time of this publication, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

Backuply <= 1.5.8 – Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation

8.0

CVSS Rating
8.0 (High)
CVE-ID

CVE-2026-93953
Affected Version(s)
<= 1.5.8
Patched Version
1.5.9
Bounty
$1,352.00

Affected Software

Backuply – Backup, Restore, Migrate and Clone [backuply]

Researcher

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup’s SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.

More Details >

Technical Analysis

Backuply is a popular WordPress plugin for creating backups and restoring, migrating, and cloning sites. When creating a database backup, it exports each table’s rows into an SQL dump, and when restoring, it executes each statement from that dump to rebuild the database.

This vulnerability is a second-order SQL injection, meaning the malicious input is stored during one action and only becomes dangerous when it is processed later during a different action.

The malicious input is planted through the Biographical Info field, which any user with an account can set on their own profile. WordPress stores this value as plain text in the wp_usermeta table.

When a database backup is created, Backuply exports the stored biography as a normal quoted value inside an INSERT statement in the SQL dump, correctly escaping it as data. The flaw appears during the restore process. The importer executes each complete statement from the dump, and then applies an unanchored regular expression to that same statement in order to discover the site’s old table prefix. Because the expression is not limited to a real CREATE TABLE header and does not skip quoted values, it also matches text inside the stored biography. When the statement additionally contains the string backuply_version, the captured text is concatenated into a second UPDATE query without any validation:

$res = backuply_mysql_query($sql, $conn);

// Find Prefix in create tables
if(preg_match('/CREATEs+TABLEs+[.]*[`]*(.*)options[`]*s*(/is', $sql, $prefix)){
	if(!empty($prefix[1])){
		$wp_old_prefix = $prefix[1];
	}
}

// If backuply_version found, then execute
if(!empty($wp_old_prefix) && preg_match('/backuply_version/is', $sql)){
	$bacuply_version_query = "UPDATE ".$wp_old_prefix."options SET `option_value`='".$GLOBALS['backuply_version']."' WHERE `option_name`='backuply_version';";
	backuply_mysql_query($bacuply_version_query, $conn);
}

Because the captured value is placed directly into the UPDATE statement as if it were a trusted table prefix, an attacker can craft their biography so that the captured text is not a prefix at all, but a complete UPDATE statement of their choosing. By ending the captured portion with a comment character, the plugin’s own trailing SQL is discarded, and only the attacker’s statement is executed.

The injected statement targets two rows in the wp_options table, default_role and users_can_register, setting default_role to administrator and users_can_register to 1. Because wp_options is restored before wp_usermeta, these changes are already in place by the time the injected query runs and persist after the restore completes.

The significance of these two options is what turns a database write into a full site takeover. When users_can_register is enabled, WordPress exposes the public registration form, and when a new user is created without an explicit role, WordPress assigns them the value stored in default_role.

After an administrator restores a backup that contains the malicious value, public registration is enabled and the default role for new accounts is set to administrator. The attacker can then simply register a new account through the standard WordPress registration form, and that account is automatically granted the administrator role, giving the attacker complete control of the site.

As with all privilege escalation vulnerabilities, this can lead to complete site compromise.

Important Note

We would like to draw attention to the fact that this vulnerability requires an administrator to restore a database backup that was created after the attacker’s malicious biography value was stored. This restore is the action that causes the injected SQL to execute. Since creating and restoring backups is the core purpose of this plugin, this is a routine action, but the injected SQL will not execute until a restore takes place.

Disclosure Timeline

2026-09-17

We received the vulnerability submission
A security researcher submitted a second-order SQL injection vulnerability in Backuply through the Wordfence Bug Bounty Program.
2026-09-19

We validated the report
Our team confirmed the proof of concept and validated the report.
2026-09-24

We deployed a firewall rule to Premium usersFirewall rule
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Backuply, hosted on WordPress.org.
2026-09-28

We disclosed the vulnerability to the vendor
We sent full disclosure details to the Backuply team.
2026-10-01

Vendor released patched version 1.5.9Patch
The vendor released the fully patched version, 1.5.9, of the plugin.
2026-10-24

We will deploy the firewall rule to free usersFirewall rule
Sites using the free version of Wordfence will receive the same protection 30 days later.
Wordfence action
Vendor / external action

Conclusion

In this blog post, we detailed a Second-Order SQL Injection vulnerability within the Backuply plugin affecting all versions up to, and including, 1.5.8. This vulnerability allows authenticated threat actors with subscriber-level access and above to store a malicious SQL payload that executes when an administrator restores a database backup, enabling them to enable public registration, set the default role to administrator, and register a new administrator account, leading to complete site compromise.

We encourage WordPress users to verify that their sites are updated to the latest patched version of Backuply as soon as possible considering the critical nature of this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Backuply, hosted on WordPress.org, on September 24, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on October 24, 2026.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.

The post 600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin appeared first on Wordfence.

]]> Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server https://swiftupdates.ca/wordfence-argus-discovers-critical-vulnerability-in-ghostscript-the-program-that-turns-uploaded-pdfs-into-thumbnails-on-your-server/ Mon, 12 Oct 2026 18:38:52 +0000 https://swiftupdates.ca/wordfence-argus-discovers-critical-vulnerability-in-ghostscript-the-program-that-turns-uploaded-pdfs-into-thumbnails-on-your-server/ On September 8, 2026, Artifex released Ghostscript 10.08.0, closing a critical heap buffer overflow that the Wordfence Threat Intelligence team, using Wordfence Argus, discovered and reported sixteen days earlier. It is tracked as CVE-2026-39919 and carries a CVSS score of 9.8 out of 10. A crafted PDF containing a JPEG 2000 image can make Ghostscript write attacker-influenced bytes past the end of a memory buffer. We developed that corruption into unauthenticated remote code execution on a purpose-built WordPress test site.

If you run a WordPress site, there isn’t a WordPress plugin to update. Ghostscript is supplied by the operating system or the container image, so most site owners will get the fix through their distribution or hosting provider. Containerized sites need to be rebuilt and redeployed from an updated base image. We tested ten Linux package environments on September 15, and the official WordPress Docker image snapshot we tested was one of the vulnerable ones.

Key Takeaways

  • Wordfence Argus found a critical CVSS 9.8 vulnerability in Ghostscript, the document engine many servers use to turn PDFs into images.
  • The fix is in Ghostscript 10.08.0. Your operating system may add the fix to an older version, so the full package revision matters more than the output of gs --version.
  • We demonstrated unauthenticated remote code execution on one exact WordPress deployment. The two proof-of-concept exploits we built were specific to the Ghostscript build they were prepared for. Our follow-up testing supports concern about targeted attacks and groups of servers that share the same build, not a single file that works everywhere.
  • This is not a WordPress-only vulnerability. Any application that sends untrusted PDFs to an affected Ghostscript build may be exposed, including document management systems, print services, invoice processors, mail gateways, and conversion APIs.
  • The official WordPress Docker image snapshot we tested was vulnerable. Stock WordPress does not let anonymous visitors upload PDFs to the Media Library, so the container on its own is not enough for an anonymous attack.
  • There is no WordPress plugin to update. Install the fixed system package, follow your vendor or host’s restart guidance, and rebuild containers from an updated base image.
  • Wordfence Argus discovered the vulnerability during a WordPress 7.1 assessment led and validated by Alex Thomas. Artifex confirmed the report the next day and shipped the fix in Ghostscript 10.08.0.

Wait, what’s Ghostscript, and what does it have to do with WordPress?

Ghostscript is a document engine. It reads PDF and PostScript files and turns their pages into images that other software can display, print, or preview. It sits underneath many applications that never mention Ghostscript by name, which is why many site owners run it without knowing they do.

WordPress does not render PDF previews itself. Since WordPress 4.7, core can generate an image of a PDF’s first page when it creates attachment metadata. On a server using the PHP Imagick extension, WordPress calls ImageMagick, which then launches Ghostscript to render the PDF.

The chain is WordPress, then Imagick, then ImageMagick, then Ghostscript. Ghostscript runs as a separate program, usually under the same account as the web server. It only starts when something asks for a picture of the PDF. A form that saves an uploaded file to disk and does nothing else with it never starts Ghostscript. A form that adds the file to the Media Library can start it when WordPress builds a preview, provided the required software and policy settings are in place.

This is not a vulnerability in WordPress or in the form plugin we used for testing. WordPress and the plugin were simply how the file reached Ghostscript. The bug is in Ghostscript.

This is a critical CVSS 9.8 vulnerability. Should I be worried?

You should patch it, but the score describes a worst case rather than a guarantee.

The CVE record assigns a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3. Those scores describe a network-facing application that accepts PDFs without a login or user action. They describe the possible impact, not whether a particular site exposes Ghostscript or whether one PDF will work against its build. Successful code execution runs with the permissions of the account processing the PDF, which is not automatically root access.

Modern systems randomize memory locations and lock down sensitive parts of a program. Those protections often turn memory corruption into a crash, but they do not fix the bug. On our purpose-built test server, we still reached code execution.

We also tested whether one exploit works everywhere. We built two working proof-of-concept exploits for our lab build, then ran them 10,240 times across ten other Linux package environments on 64-bit Intel and AMD systems: Debian, Ubuntu, Fedora, AlmaLinux, Alpine, and the official WordPress container. Neither succeeded once outside the matching build, while both continued to work on that build. We then kept the Ghostscript executable the same and changed fonts, language settings, font configuration, and one core system library. The same exploit still succeeded in all four setups, although it did not succeed on every attempt.

That makes the exact build important, but our experiment did not measure how easily an attacker could identify it remotely or how long adapting an exploit would take. A targeted attacker may have better information, and a hosting platform may expose the same build across many sites. On our purpose-built form, failed attempts returned a successful upload response while Ghostscript crashed in the background. Other sites may log, block, or rate-limit repeated uploads.

Our two files did not work unchanged across the mixed package set. That is strong evidence against treating either file as a universal exploit, but it does not rule out a different file or a set of files prepared for common builds. We did not measure package prevalence or remote build identification, so we cannot give a success rate across the Internet. Site owners should patch, especially if they accept public documents or run many sites from one shared image.

What HEIF Heist tells us about this vulnerability

Heap buffer overflows are sometimes dismissed as too unreliable to matter on modern servers. Memory randomization and other protections do make them harder to exploit, and a working exploit may need to be tailored to a particular software build. But harder is not the same as safe.

That is the important connection between this Ghostscript vulnerability, our earlier libheif finding, and Hacktron’s HEIF Heist research. Both Wordfence Argus findings are heap buffer overflows in native file-processing code that can be reached through an uploaded file. In both cases, our working code-execution exploit depended on the target build rather than serving as one universal payload.

HEIF Heist shows why that limitation should not be mistaken for protection. Hacktron used AI-assisted exploit development to turn a heap buffer overflow in libheif into reliable code execution against OpenAI’s Discourse forum. Its broader research found paths to code execution or data exposure in other real services and products, including Next.js applications. Hacktron reported that adapting an exploit to each new company usually took one or two days, even when the team initially knew little about the target environment. Some attempts required thousands of uploaded images, but the team still reached code execution or read data from server memory.

Our Ghostscript experiments point to the same threat model. The two files we built failed in 10,240 attempts across ten different package environments, but a build-matched exploit continued to succeed in all four setups that shared the exact Ghostscript executable. Attackers do not need one PDF that works everywhere if they can focus on a known target or many servers built from the same image. HEIF Heist does not prove that this exact Ghostscript flaw can be adapted in one or two days, and we have found no public evidence that it is being exploited today. It does show why the difficulty of exploiting a heap overflow is not a defense and should not delay patching.

Is my WordPress site affected?

If visitors or users with limited permissions can upload PDFs to your WordPress site, you should assume the site is affected until your host confirms otherwise. This attack reaches Ghostscript when WordPress or another tool creates a preview, thumbnail, or image from the PDF. If uploaded PDFs are only stored and never processed, this path is not exposed, but many site owners will not know what happens behind the scenes. Ask your hosting provider whether uploaded PDFs reach Ghostscript. If they do, use the package guidance below to confirm that the fix is installed.

Install the fixed Ghostscript package supplied by your operating system or hosting provider. Artifex fixed the flaw in Ghostscript 10.08.0, but Linux distributions often add the fix to the older version they already ship. That means gs --version may not tell you on its own whether you are patched. Ubuntu 22.04, for example, fixed this in package 9.55.0~dfsg1-0ubuntu5.14, which still reports Ghostscript 9.55.0. Check the full package revision using dpkg -s ghostscript on Debian and Ubuntu, or rpm -q ghostscript on Fedora and the Red Hat family. Install the fixed package and follow your vendor or host’s restart guidance. For containers, rebuild and redeploy from an updated base image rather than restarting the old container.

Your site can be attacked this way only if all of these are true at once:

  1. A visitor, or someone with a low-privileged account, can upload a PDF
  2. Something on your site then asks for a preview or thumbnail of that PDF
  3. Your server has Imagick, or another tool that calls Ghostscript to make that picture
  4. Your installed Ghostscript does not have the fix

Source history places the affected code in Ghostscript 9.21 through 10.07.1 when the OpenJPEG decoder path is present. All ten package environments we tested contained that path. A version in that range shows that the package was originally affected, but only the full package revision or your distribution’s advisory can tell you whether the fix was added later. What each system ships changes over time, so this table records the exact packages we tested on September 15:

Platform Package revision tested Affected in our Sept. 15 test?
Official wordpress Docker image 10.05.1~dfsg-1+deb13u1 Yes
Debian 13 trixie (current stable) 10.05.1~dfsg-1+deb13u1 Yes
Debian 12 bookworm 10.0.0~dfsg-11+deb12u8 Yes
Ubuntu 22.04 LTS 9.55.0~dfsg1-0ubuntu5.13 Yes
Ubuntu 24.04 LTS 10.02.1~dfsg1-0ubuntu7.8 Yes
Ubuntu 26.04 10.06.0~dfsg-3ubuntu1 Yes
Fedora 44 10.06.0-2.fc44 Yes
AlmaLinux 10 10.02.1-16.el10_0 Yes
Alpine 3.22 10.05.1-r0 Yes
Alpine 3.23 10.06.0-r0 Yes

For comparison, the final Ghostscript 10.08.0 release contains Artifex’s fix. The table covers only the dated distribution and container packages we tested, so the official 10.08.0 release is not included.

Our test PDF crashed Ghostscript on nine of the ten systems. Debian 12 rendered that particular file without crashing, but when we changed the dimensions inside the image and tried again, 28 of 40 of those variations crashed it too. A file that does not crash your server is not proof that your server is safe.

Since we ran those tests, fixed packages have shipped for several of these systems. Ubuntu has fixed 22.04, 24.04, and 26.04. Debian has fixed 13 through its security repository, while Debian 12 remains listed as vulnerable. AlmaLinux 10 published its fix on October 2.

As of October 9, the official package pages for Fedora 44, Alpine 3.22, and Alpine 3.23 still listed the older revisions shown in our table. Check your distribution’s advisory for the exact fixed package revision.

The release candidate for 10.08.0 also reports 10.08.0 and is not fixed, which is what our own test machine was running. Confirm you have the final release, or a distribution package that carries the fix.

The exact official WordPress Docker image snapshot we tested already contained the vulnerable Ghostscript package and the software needed to reach it. It contained Ghostscript 10.05.1, the Imagick extension, and a working PDF preview path. Stock WordPress still did not give anonymous visitors a way to upload a PDF for preview. An attacker would need a plugin, form, application route, or account that provides that path. If you use the official image, pull an updated base, rebuild without relying on a cached layer, and redeploy.

Site Health is only a starting point. Under Tools → Site Health → Info → Media Handling, WordPress can show whether Imagick recognizes PDF as a format. That does not prove ImageMagick’s policy permits PDF reads, and it does not tell you whether Ghostscript is patched. Your host, operating system package manager, or container supplier is the authority on the installed fix.

If you can’t patch immediately:

  • Stop accepting PDFs from visitors and low-privileged users. This keeps those files from reaching the converter at all.
  • Disable PDF reads in ImageMagick’s security policy. This also disables PDF previews.
  • Limit the number of files per submission and rate limit upload forms. This reduces an attacker’s opportunities, but it does not close the vulnerability.

Regarding that last bullet point: if the first preview attempt fails, WordPress tries again with a different setting. If both attempts fail, WordPress returns an image-processing error; in our form-based test, the upload itself still returned success. This retry is part of WordPress core’s Imagick PDF loader and has been there since version 5.6, as a workaround for an old Ghostscript compatibility problem (Trac #48853). We measured one Ghostscript process for a harmless PDF and two for a crashing PDF. Three attachments produced six processes. Limiting files per submission therefore reduces the number of processing attempts an attacker gets in one request, but it does not fix the vulnerability.

Do not treat -dSAFER as a fix. Ghostscript’s sandbox restricts what a document is allowed to do through supported features. It does not prevent memory corruption, and our testing reached the flaw with the sandbox enabled.

Managed hosting customers can’t check most of this themselves. It’s reasonable to ask your host whether its Ghostscript package includes the fix for CVE-2026-39919, and whether PDFs uploaded by customers get turned into previews anywhere on its systems. High-value sites and groups of sites built from a shared image deserve particular attention, because many systems may present the same build to an attacker.

What this means for everyone else using Ghostscript

Nothing about this flaw is specific to WordPress. WordPress is one route that can deliver an untrusted PDF to Ghostscript, and the same question applies anywhere Ghostscript is used: does this software render PDFs that came from somebody else?

Document management systems, print services, invoice processors, preview generators, mail gateways, and conversion APIs can all do this. If any of them send untrusted documents to an affected Ghostscript build, treat the update as urgent. Searching your application code for the word “Ghostscript” may miss the dependency entirely, because ImageMagick or another library usually sits between the application and the converter.

If you cannot patch every system at once, run document conversion in a separate, locked-down service that cannot read site secrets or connect to anything it does not need. That limits what a compromised converter can reach, but it is not a fix.

Vulnerability Summary

Artifex Ghostscript 9.21 through 10.07.1 – Heap-based Buffer Overflow Can Lead to Remote Code Execution

9.8
CVSS Rating
9.8 (Critical)
CVSS 4.0 Rating
9.3 (Critical)
CVE-ID
CVE-2026-39919
Affected Upstream Version(s)
9.21 – 10.07.1
Upstream Fixed Version
10.08.0
Affected Software

Artifex Ghostscript [ArtifexSoftware/ghostpdl]
Researchers

Artifex Ghostscript is vulnerable to a heap-based buffer overflow in its JPEG 2000 decoding path in versions 9.21 through 10.07.1, where the OpenJPEG decoder is present. A crafted PDF containing a JPEG 2000 image with sub-byte sample precision and mismatched component resolutions can write attacker-influenced bytes past the end of a heap buffer and overwrite memory-management data that Ghostscript later uses. In affected applications and server configurations, this can result in remote code execution, and the write occurs even when Ghostscript is run with -dSAFER. The CVE record states the affected range as “before 10.08.0”; the vulnerable sub-byte sampling block was introduced in 9.21. The vulnerability is fixed in Ghostscript 10.08.0.
More Details >

How we found it

We found this vulnerability with Wordfence Argus, our AI-assisted security testing system, during a WordPress 7.1 security assessment.

Argus followed an uploaded file past the PHP code that accepted it. For a PDF preview, that meant tracing the data through Imagick and ImageMagick into Ghostscript and the JPEG 2000 decoder below it. A visible upload handler can validate and store a file perfectly well while a system program mishandles it moments later.

The vulnerabilities that hurt WordPress sites don’t always live in WordPress itself. Some of them live several layers down, in software site owners never chose on their own, reached by a feature as mundane as uploading a document. Defending the platform properly means following the data all the way down. You can read more about Argus in our earlier post.

Our mission is to secure WordPress at every layer. That includes finding vulnerabilities in the software WordPress relies on, alongside our Bug Bounty Program.

How the bug actually works

You don’t need to know C to follow this.

An image is a grid of samples. A grayscale image has one brightness sample for each pixel. An image with transparency adds another set of samples describing how transparent each pixel is. JPEG 2000 calls each set a component.

JPEG 2000 lets those components differ. Components may have different resolutions, and each sample may use fewer than eight bits. With two-bit samples, four samples fit into a single byte.

A program reading an image asks the system for a block of memory big enough to hold it. That block is a buffer. If the program writes more data than the buffer can hold, the extra spills into memory beyond it, which may hold other data or the program’s own bookkeeping. That is dangerous, because corrupting nearby memory can change how the program behaves. If an attacker controls what gets written, they may be able to steer the program into running code of their choosing. This is a buffer overflow.

The bug appears when Ghostscript handles those two JPEG 2000 features together. In the minimal public test case, a row contains 1,024 two-bit samples. The correct packed size is 256 bytes, and Ghostscript correctly reserves 256 bytes. The loop that fills the row then writes one whole byte for each sample instead of packing four samples into each byte. It writes 1,024 bytes into a 256-byte buffer.

Imagine reserving 256 mailboxes because each one holds four small letters. That is enough room for 1,024 letters. The delivery loop forgets the four-per-box rule and puts one letter in each box. After 256 letters it keeps right on delivering, into whatever sits beyond the mailboxes.

In Ghostscript, what sat beyond them was bookkeeping used to manage allocated objects. The 768 bytes that spill out on each row are derived from image samples chosen by whoever made the file. They are constrained by the image format and by Ghostscript’s packing loop, but they can still corrupt memory addresses that Ghostscript follows later while cleaning up. That is how this flaw becomes more than a crash.

Artifex’s fix changes the loop so it counts samples correctly and rejects bit depths that this code path does not support.

The 1,029-byte public test file differs from a harmless control file by a single byte, in a field describing the transparency component’s resolution. Both are valid PDFs containing a valid JPEG 2000 image. The dangerous condition is buried in the image’s internal geometry, so ordinary checks of the extension, MIME type, or basic file structure do not identify it.

Timeline

2026-08-23

Wordfence Argus discovered the vulnerability
Wordfence Argus discovered the vulnerability during a WordPress 7.1 assessment. We reduced it to a 1,029-byte PDF, confirmed release-build behavior on Ghostscript 10.08.0rc1 and 10.07.1, confirmed the memory corruption with a diagnostic build and a matched control file, and demonstrated unauthenticated code execution on a purpose-built WordPress test site. We then reported it privately to Artifex with a root cause analysis and a suggested fix.
2026-08-24

Artifex confirmed the report
Artifex confirmed the report and prepared a fix.
2026-09-08

Patched release published
Artifex released Ghostscript 10.08.0 with the fix.
2026-09-15

CVE record published
CVE-2026-39919 was published.
2026-09-16

Follow-up research
We completed the cross-build and same-executable portability study summarized above.
Wordfence action
Vendor / external action

Conclusion

Wordfence Argus found a critical heap buffer overflow in Ghostscript 9.21 through 10.07.1, several layers beneath an ordinary WordPress document upload. We did not stop after making the vulnerable program crash. On one exact WordPress deployment, we demonstrated that a crafted PDF could be turned into unauthenticated code execution on the server, with Ghostscript’s -dSAFER sandbox enabled.

The two proof-of-concept exploits we built did not work unchanged on ten other package environments, so this is not one universal PDF that can compromise every vulnerable server. The more credible threats are a targeted attack against a known build and an attack against many sites sharing one hosting or container image. Hacktron’s HEIF Heist research is a warning not to mistake that limitation for safety: AI-assisted researchers turned build-specific memory corruption in libheif into successful attacks against real services. That does not establish an exploitation timetable for this Ghostscript vulnerability, but our own tests showed that a matching exploit continued to work across all four setups that shared the exact Ghostscript executable. Build-specific exploitation is harder, not harmless.

This is exactly why we built Wordfence Argus. Securing WordPress means looking beyond WordPress core and plugins, then following untrusted data through every layer that handles it. In this case, Argus followed a document upload into a system program most site owners did not know they were running, found a critical vulnerability, and gave our researchers a path to prove what it could mean on a working WordPress test site.

Whether you’re exposed depends on your Ghostscript package and how your application handles documents. Install the fixed system package, follow your vendor or host’s restart guidance, and rebuild container images from an updated base. If you can’t update yet, stop untrusted PDFs from reaching Ghostscript.

Our thanks go to Ken Sharp and the Artifex team, who confirmed the report the day after we filed it and shipped the fix, and the VulnCheck team for a quick CVE assignment.

If you know someone running a site that accepts document uploads, please share this advisory with them.

The post Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-28-2026-to-october-4-2026/ Fri, 09 Oct 2026 17:39:36 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-28-2026-to-october-4-2026/ Last week, there were 501 vulnerabilities disclosed in 367 WordPress Plugins and 9 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 201 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-963 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 449
Unpatched 52

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 306
High Severity 174
Critical Severity 20

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 206
Missing Authorization 68
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 42
Exposure of Sensitive Information to an Unauthorized Actor 34
Deserialization of Untrusted Data 30
Authorization Bypass Through User-Controlled Key 23
Improper Control of Generation of Code (‘Code Injection’) 14
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 13
Improper Privilege Management 13
Client-Side Enforcement of Server-Side Security 9
Improper Authentication 8
Cross-Site Request Forgery (CSRF) 7
Unrestricted Upload of File with Dangerous Type 5
Server-Side Request Forgery (SSRF) 4
Uncontrolled Resource Consumption 4
External Control of File Name or Path 3
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
URL Redirection to Untrusted Site (‘Open Redirect’) 3
Improper Input Validation 2
Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) 1
Guessable CAPTCHA 1
Improper Authorization 1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) 1
Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) 1
Incorrect Authorization 1
Insufficiently Protected Credentials 1
Path Traversal: ‘/dir/../filename’ 1
Protection Mechanism Failure 1
Use of Hard-coded Password 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

72

19

14

12

12

10

9

9

7

7
5a50351dc3a5975487697a55ad3936d5
UKO

7

7

6

6

5

5

5

5

5

4

4

4

4

4

4

4

4

4

4

3

3

3
efd10eb3421a6ca0a3d855ad7029a801
V1T

3

3

3

3

3

3

3

3

3

3

3
1e008e2827556f92e4e1199ee59c1c4d
dcs

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning academy
Aculect AI Companion aculect-ai-companion
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress acymailing
Ad Inserter – Ad Manager & AdSense Ads ad-inserter
Advanced Ads – Ad Manager & AdSense advanced-ads
Advanced Partial Payment or Deposit for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce
Advanced Post Manager advanced-post-manager
Advanced Woo Labels – Product Labels & Badges for WooCommerce advanced-woo-labels
AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo
AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine
Airano MCP Bridge airano-mcp-bridge
Ajax Search Pro ajax-search-pro
All in One Files Upload for WooCommerce all-in-one-files-upload-for-woocommerce
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) all-in-one-seo-pack
AllAble Connector allable-connector
Alt Text AI – Automatically generate image alt text for SEO and accessibility alttext-ai
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint
Appointment Hour Booking – Booking Calendar appointment-hour-booking
Aruba Migration Tool aruba-wp-migration-tool
Audio Player Block – Advanced Block for Embedding Audio Files audio-player-block
Authorizer authorizer
Autoptimize autoptimize
Awesome Support – WordPress HelpDesk & Support Plugin awesome-support
BA Book Everything ba-book-everything
BackupEase – Scheduled Backup, Restore & Site Migration backupease
BackupSheep WordPress Backup Plugin backupsheep
bbp style pack bbp-style-pack
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) woo-bulk-editor
Beaver Builder Page Builder – Drag and Drop Website Builder beaver-builder-lite-version
BlockStrap Page Builder – Bootstrap Blocks blockstrap-page-builder-blocks
Bold Page Builder bold-page-builder
Booking Activities booking-activities
Booking Calendar booking
Books Gallery – Book Showcase, Library & Affiliate Plugin wp-books-gallery
Branda – White Label & Branding, Free Login Page Customizer branda-white-labeling
Broken Link Notifier broken-link-notifier
BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) burst-statistics
Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation
Business Directory Plugin – Easy Listing & Member Directories for WordPress business-directory-plugin
Business Essentials for Contact Form 7 cf7-redirect-thank-you-page
ByteCoreStack – MCP Connector for AI Tools bcs-mcp-manager
Cache Enabler cache-enabler
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More calculated-fields-form
Captivate Sync captivatesync-trade
CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 contact-form-7-honeypot
CF7 Views – Complete Entry Management for Contact Form 7 cf7-views
Classified Listing – AI-Powered Classified ads & Business Directory classified-listing
CMB2 cmb2
CMP – Coming Soon & Maintenance Plugin by NiteoThemes cmp-coming-soon-maintenance
CoCart – Headless REST API for WooCommerce cart-rest-api-for-woocommerce
Connections Business Directory connections
Content Egg – Affiliate Product Importer & Price Comparison content-egg
ConvertPlus convertplug
Cool FormKit Lite – Advanced Form Builder for Elementor extensions-for-elementor-form
Cost Calculator Builder cost-calculator-builder
Cost of Goods: Product Cost & Profit Calculator for WooCommerce cost-of-goods-for-woocommerce
Course Booking System course-booking-system
Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates cozy-addons
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators creatorlms
CTX Feed Pro webappick-product-feed-for-woocommerce-pro
CURCY – Multi Currency for WooCommerce woo-multi-currency
Customer Reviews for WooCommerce customer-reviews-woocommerce
Deema Payment Gateway deema-payment-gateway
DesignSetGo designsetgo
DevKit Pro devkit
Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts
Divi Membership divi-membership
DoFollow Case by Case dofollow-case-by-case
Download Manager downloadmanager
Download Manager download-manager
Download Monitor download-monitor
Duplicate Post copy-delete-posts
Easy Google Maps google-maps-easy
Easy PayPal & Stripe Buy Now Button wp-ecommerce-paypal
eCommerce Product Catalog ecommerce-product-catalog
ECPay Ecommerce for WooCommerce ecpay-ecommerce-for-woocommerce
EduAdmin Booking eduadmin-booking
elegro Crypto Payment elegro-payment
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor elementskit-lite
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents embedpress
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce erp
Essential Addons for Elementor – Popular Elementor Templates & Widgets essential-addons-for-elementor-lite
Event Tickets and Registration event-tickets
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI everest-forms
EWWW Image Optimizer ewww-image-optimizer
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export wp-ultimate-exporter
Extendify extendify
Extra Product Options For WooCommerce | Custom Product Addons and Fields woo-extra-product-options
Faktur Pro for WooCommerce woorechnung
Fast Courier – Shipping & Freight fast-courier-shipping-freight
Featured Image from URL (FIFU) featured-image-from-url
File Media Renamer file-media-renamer
File Uploads Addon for WooCommerce woo-addon-uploads
Five Star Business Profile and Schema business-profile
Five Star Restaurant Reservations – WordPress Booking Plugin restaurant-reservations
Five Star Restaurant Reviews good-reviews-wp
Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce flexible-coupons
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder fluentform
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration fluent-boards
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler fluent-cart
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More formgent
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
Frontend File Manager Plugin nmedia-user-file-uploader
Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms frontend-post-submission-manager-lite
GD Rating System gd-rating-system
Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7
Geo Mashup geo-mashup
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers rafflepress
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce
GravityExport Lite for Gravity Forms gf-entries-in-excel
Greenshift – animation and page builder blocks greenshift-animation-and-page-builder-blocks
Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg
GSpeech TTS – WordPress Text To Speech Plugin gspeech
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns essential-blocks
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates happy-elementor-addons
hCaptcha for WP hcaptcha-for-forms-and-more
Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce
Hide Shipping Method For WooCommerce hide-shipping-method-for-woocommerce
Horizontal scrolling announcements horizontal-scrolling-announcements
Hostinger Migrator migrator-plugin
Hostinger Reach – AI-Powered Email Marketing for WordPress hostinger-reach
HT Contact Form – Drag & Drop Form Builder for WordPress ht-contactform
HT Mega Addons for Elementor – Elementor Widgets & Template Builder ht-mega-for-elementor
Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT hyve-lite
IATO MCP iato-mcp
Icegram Engage – Popups, Optins, CTAs & Lead Generation icegram
If-So Dynamic Content – Elementor & All Page Builders Personalization if-so
Image Optimizer image-optimizer
InPost PL inpost-for-woocommerce
Iptanus File Upload wp-file-upload
Issues and Series for Newspapers, Magazines, Publishers, Writers organize-series
Ivory Search – WordPress Search Plugin add-search-to-menu
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress jeg-elementor-kit
JetAppointment jet-appointments-booking
JetBlog jet-blog
JetEngine jet-engine
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
JetReviews jet-reviews
JNews – Pay Writer jnews-pay-writer
JSON API Auth json-api-auth
JW Player for WordPress jw-player-7-for-wp
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor kadence-blocks
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder king-addons
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Kognetiks Chatbot chatbot-chatgpt
Kubio AI Page Builder kubio
LA-Studio Element Kit for Elementor lastudio-element-kit
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
Listdom: AI-powered Business Directory with Classifieds Ads Listings listdom
Loco Translate loco-translate
Lookzy LookBook for WooCommerce woo-lookbook
Magic Tooltips For Contact Form 7 magic-tooltips-for-contact-form-7
Mail logging & Catcher wp-mail-catcher
Mailchimp for WooCommerce mailchimp-for-woocommerce
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support
MakeCommerce for WooCommerce makecommerce
Mang Board mangboard
MaxGalleria maxgalleria
MCP Content Manager Lite mcp-content-manager-lite
Media Library Assistant media-library-assistant
Media Library Organizer – Folders, File Manager & Media Categories media-library-organizer
Memberful – Membership Plugin memberful-wp
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor metform
Mindio Magic MCP mindio-magic-mcp
Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce
Mooberry Book Manager mooberry-book-manager
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO multiple-pages-generator-by-porthas
MStore API – Create Native Android & iOS Apps On The Cloud mstore-api
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor
Music Player for WooCommerce music-player-for-woocommerce
MW WP Form mw-wp-form
Nelio Content – Editorial Calendar & Social Media Auto-Posting nelio-content
Nested Pages wp-nested-pages
New User Approve new-user-approve
Newsletter – Send awesome emails from WordPress newsletter
Newsletters, Email Marketing, SMS and Popups by Omnisend omnisend
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
Ninja Forms – File Uploads ninja-forms-uploads
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder ninja-forms
No External Links mihdan-no-external-links
Notification for Telegram notification-for-telegram
Notivo Notification for WooCommerce woo-notification
OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook
Ohio Extra ohio-extra
oik oik
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. host-webfonts-local
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE otter-blocks
Page Builder by SiteOrigin siteorigin-panels
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Parallax Section Block – Add Parallax Scrolling Effects to Sections parallax-section
Pay with Vipps and MobilePay for WooCommerce woo-vipps
Payflex Payment Gateway payflex-payment-gateway
Payments for Hubtel payments-hubtel
Paytm Payment Gateway paytm-payments
PDF for Contact Form 7 + Drag and Drop Template Builder pdf-for-contact-form-7
PDF Invoices & Packing Slips for WooCommerce woocommerce-pdf-invoices-packing-slips
PDF Smart Viewer for Elementor pdf-smart-viewer-for-elementor
Persistent Login wp-persistent-login
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Photo Gallery – Responsive Image Galleries by Supsystic gallery-by-supsystic
Photo Reviews for WooCommerce woo-photo-reviews
Photonic Gallery & Lightbox for Flickr, SmugMug & Others photonic
Pie Register – User Registration, Profiles & Content Restriction pie-register
Pixfort Core pixfort-core
Polylang polylang
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More popup-maker-wp
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor post-and-page-builder
Post Views Stats Counter post-views-stats-counter
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates premium-addons-for-elementor
Premmerce Permalink Manager for WooCommerce woo-permalink-manager
Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist
Prevent Files / Folders Access prevent-file-access
Pricing Table WordPress Plugin – Easy Pricing Tables easy-pricing-tables
Prime Mover – Backup and Migration prime-mover
Pro Like Button prolike-button
Product Designer App product-designer-app
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce woo-product-feed-pro
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Progress Planner progress-planner
Progressify – All-in-One Progressive Web App (PWA) progressify
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker wedevs-project-manager
Qi Addons For Elementor qi-addons-for-elementor
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker quiz-master-next
Quiz Cat – WordPress Quiz Plugin quiz-cat
Razorpay for WooCommerce woo-razorpay
Razorpay Payment Links for WooCommerce rzp-woocommerce
ReactPress – Create React App for WordPress reactpress
Real Cookie Banner: GDPR & ePrivacy Cookie Consent real-cookie-banner
Real Estate Manager – Property Listing and Agent Management real-estate-manager
Redux Framework redux-framework
Relevanssi Premium relevanssi-premium
Relevanssi – A Better Search relevanssi
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress computer-repair-shop
Request a Quote – Quote Forms for Any WordPress Site request-a-quote
Responsive Slider Gallery – Responsive Image Photo Slider responsive-slider-gallery
Responsive Starter Templates – Elementor Templates & Starter Sites responsive-add-ons
REST API Log wp-rest-api-log
Rich Showcase for Google Reviews widget-google-reviews
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF robin-image-optimizer
Safe Redirect Manager safe-redirect-manager
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas salon-booking-system
SaveTo Wishlist Lite – WooCommerce Wishlist saveto-wishlist-lite-for-woocommerce
Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO review-schema
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more scratch-win-giveaways-for-website-facebook
Search in Place search-in-place
SEOPress – AI SEO Plugin & On-site SEO wp-seopress
Sermon’e sermone
ShopBuilder – WooCommerce Builder For Elementor shopbuilder
Simple Event Planner simple-event-planner
Simple Membership simple-membership
Simple Payment simple-payment
Simple Shopping Cart wordpress-simple-paypal-shopping-cart
Simply Schedule Appointments simply-schedule-appointments
Site Reviews site-reviews
SiteOrigin Widgets Bundle so-widgets-bundle
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP siteskite
Slider Pro slider-pro-wp
Smart Forms – when you need more than just a contact form smart-forms
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) smart-manager-for-wp-e-commerce
Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup
Smart Popup by Supsystic popup-by-supsystic
Smart Slider 3 smart-slider-3
SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more wc-ukr-shipping
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress custom-facebook-feed
Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more social-boost
Social Media Share Buttons & Social Sharing Icons ultimate-social-media-icons
Social Sharing Plugin – Sassy Social Share sassy-social-share
Solace Extra solace-extra
StifLi Backup Tools stifli-backup-tools
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions wp-full-stripe-free
Strong Testimonials strong-testimonials
SUMO Affiliates Pro affs
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers sunshine-photo-cart
Super Forms – Drag & Drop Form Builder super-forms
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent supportcandy
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder supreme-modules-for-divi
Tabs Responsive – With WooCommerce Product Tabs Extension tabs-responsive
tagDiv Opt-In Builder td-subscription
Taskbuilder – Project Management & Task Management Tool With Kanban Board taskbuilder
The Events Calendar the-events-calendar
ThemeREX Addons trx_addons
Themify Builder themify-builder
TillKit tillkit
Timetics – Appointment Booking Calendar & Scheduling timetics
Total Donations totaldonations
TranslatePress – Translate Multilingual sites with AI Translation translatepress-multilingual
Transliterator – Multilingual and Multi-script Text Conversion serbian-transliteration
Travelly – Tour & Travel Booking Manager for WooCommerce tour-booking-manager
Trusted Shops Easy Integration for WooCommerce trusted-shops-easy-integration-for-woocommerce
Twenty20 Image Before-After twenty20
Two Factor two-factor
Ultimate Maps by Supsystic ultimate-maps-by-supsystic
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform ultimate-multisite
Ultra Addons Lite for Elementor ut-elementor-addons-lite
Unlimited Elements for Elementor unlimited-elements-for-elementor
UPI QR Code Payment Gateway upi-qr-code-payment-gateway
UpSolution Core us-core
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission wp-user-frontend
User Private Files – Secure File Sharing and Client Portal Plugin user-private-files
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration
User Submitted Posts – Enable Users to Submit Posts from the Front End user-submitted-posts
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP userswp
Verge3D Publishing and E-Commerce verge3d
Viable URL Media Uploader viable-url-media-uploader
VikAppointments Services Booking Calendar vikappointments
VikBooking Hotel Booking Engine & PMS vikbooking
Virtue/Ascend/Pinnacle Toolkit virtue-toolkit
Visitor Traffic Real Time Statistics visitors-traffic-real-time-statistics
Visitor Traffic Real Time Statistics pro visitors-traffic-real-time-statistics-pro
Visual Composer Website Builder visualcomposer
Vitepos – Point of Sale (POS) for WooCommerce vitepos-lite
VK Google Job Posting Manager vk-google-job-posting-manager
W3 Total Cache w3-total-cache
WDS MCP Content Manager wds-mcp-content-manager
WEBO MCP webo-mcp
WebSamurai websamurai
WebToffee Gift Cards for WooCommerce wt-gift-cards-woocommerce
WebToffee WP Backup and Migration wp-migration-duplicator
Welcart e-Commerce usc-e-shop
WooCommerce Appointments woocommerce-appointments
WooCommerce Designer Pro wc-designer-pro
WooCommerce Lottery wc-lottery
WP 2FA – Two-factor authentication for WordPress wp-2fa
WP Activity Log wp-security-audit-log
WP BASE Booking of Appointments, Services and Events wp-base-booking-of-appointments-services-and-events
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps wp-data-access
WP Directory Kit wpdirectorykit
WP Express Checkout (Fast Payments via PayPal & Stripe) wp-express-checkout
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress wp-fusion-lite
WP Mail Logging wp-mail-logging
WP Media folder wp-media-folder
WP Mobile Menu – The Mobile-Friendly Responsive Menu mobile-menu
WP OAuth Server (OAuth Authentication) oauth2-provider
WP Photo Album Plus wp-photo-album-plus
WP Popular Posts wordpress-popular-posts
Wp Social Login and Register Social Counter wp-social
WP Spell Check wp-spell-check
WP Statistics – Simple, privacy-friendly Google Analytics alternative wp-statistics
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export wp-ultimate-csv-importer
WP Ultimate Review wp-ultimate-review
WP User Frontend Pro wp-user-frontend-pro
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory wp-user-manager
WP Visitor Statistics (Real Time Traffic) wp-stats-manager
WPBot – ChatBot Conversational Forms conversational-forms
WPC Estimated Delivery Date for WooCommerce wpc-estimated-delivery-date
WPC Product Options for WooCommerce wpc-product-options
WPC Shop as a Customer for WooCommerce wpc-shop-as-customer
WPC Smart Quick View for WooCommerce woo-smart-quick-view
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System wp-cafe
WPEPP – Essential Security, Password Protect & Login Page Customizer wp-edit-password-protected
WPFront Notification Bar wpfront-notification-bar
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell wpfunnels
WPML Multilingual & Multicurrency for WooCommerce woocommerce-multilingual
WPMobile.App – Android and iOS App Builder wpappninja
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons social-icons-widget-by-wpzoom
YayReviews – Advanced Customer Reviews for WooCommerce yay-customer-reviews-woocommerce
YITH WooCommerce Tab Manager yith-woocommerce-tab-manager
Zombify zombify
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 pgall-for-woocommerce

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Astra astra
Avada | Website Builder For WordPress & WooCommerce Avada
Betheme betheme
Grand Restaurant WordPress grandrestaurant
Haaken – Fashion Store WordPress Theme haaken
Vayu X vayu-x
Virtue Premium virtue_premium
Wallstreet wallstreet
zella-theme zella-theme

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-94389
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researcher

More Details >

DevKit Pro <= 2.3.0 – Unauthenticated Authentication Bypass to Administrator Account Takeover via ‘original_user_id’ Cookie in Frontend Revert Switch Flow

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14378
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

DevKit Pro [devkit]

Researcher

More Details >

Divi Membership <= 2.2.0 – Unauthenticated Privilege Escalation via ‘form_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-19652
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Divi Membership [divi-membership]

Researcher

More Details >

Divi Membership <= 2.3.0 – Unauthenticated Authentication Bypass via ‘paypal_param’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-19660
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Divi Membership [divi-membership]

Researcher

More Details >

JSON API Auth <= 3.1.2 – Unauthenticated Authentication Bypass via Cached ‘generate_auth_cookie’ Response

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-97637
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

JSON API Auth [json-api-auth]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-103065
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Kognetiks Chatbot <= 2.4.9 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-32579
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Kognetiks Chatbot [chatbot-chatgpt]

Researcher

More Details >

SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.8 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-96349
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP [siteskite]

Researcher

More Details >

Super Forms <= 6.3.316 – Unauthenticated Privilege Escalation via ‘role’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-15989
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

More Details >

Ultimate Multisite <= 2.15.0 – Unauthenticated Authentication Bypass via ‘checkout_form’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-75957
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform [ultimate-multisite]

Researcher

More Details >

WPMobile.App <= 11.82 – Unauthenticated Admin Account Takeover via ‘wpapp_category[]’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-94541
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WPMobile.App – Android and iOS App Builder [wpappninja]

Researcher

More Details >

Zella <= 2.6.2 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-75873
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

zella-theme [zella-theme]

Researcher

More Details >

Zombify <= 1.7.7 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-94503
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Zombify [zombify]

Researcher

More Details >

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-95588
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researcher

More Details >

Appointment Booking Plugin <= 5.7.0 – Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-92966
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

BackupSheep <= 1.8 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-101148
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

BackupSheep WordPress Backup Plugin [backupsheep]

Researchers

More Details >

Beaver Builder Page Builder <= 2.11.0.5 – Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-92084
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]

Researcher

More Details >

Cache Enabler <= 1.8.16 – Unauthenticated Arbitrary File and Directory Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-19253
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Cache Enabler [cache-enabler]

Researcher

More Details >

Super Forms <= 6.3.316 – Unauthenticated Path Traversal to Arbitrary File Read via ‘sfgtfi’ URL Path Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-15896
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

More Details >

VikAppointments Services Booking Calendar <= 1.2.21 – Unauthenticated Arbitrary File Deletion via ‘old_vapcfN’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-87115
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

VikAppointments Services Booking Calendar [vikappointments]

Researcher

More Details >

ByteCoreStack <= 1.2.3 – Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-19807
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

ByteCoreStack – MCP Connector for AI Tools [bcs-mcp-manager]

Researcher

More Details >

CoCart 4.9.0 – 4.9.6 – Cross-Site Request Forgery to Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-93549
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

CoCart – Headless REST API for WooCommerce [cart-rest-api-for-woocommerce]

Researcher

More Details >

ConvertPlus <= 3.6.3 – Authenticated (Subscriber+) PHP Object Injection via ‘style’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-87741
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

ConvertPlus [convertplug]

Researcher

More Details >

Featured Image from URL (FIFU) Free & Premium <= 6.0.7 – Cross-Site Request Forgery

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-101147
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Featured Image from URL (FIFU) [featured-image-from-url]

Researchers

More Details >

Groundhogg <= 4.9 – Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to ‘user_id’ Parameter (v3 /contacts) chained with v4 /emails/test

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-97644
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 – Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-92536
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar]

Researcher

More Details >

Prime Mover – Backup and Migration <= 2.2.0 – Authenticated (Admin+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-101888
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Prime Mover – Backup and Migration [prime-mover]

Researcher

More Details >

Smart Manager <= 8.97.0 – Authenticated (Subscriber+) SQL Injection to Privilege Escalation via ‘access_privileges’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-18443
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) [smart-manager-for-wp-e-commerce]

Researcher

More Details >

Super Forms – Drag & Drop Form Builder <= 6.3.316 – Authenticated (Subscriber+) Privilege Escalation via ‘user_id’ Parameter in Register & Login

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-15897
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

More Details >

WooCommerce Designer Pro <= 1.9.33 – Authenticated (Subscriber+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-32568
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

WooCommerce Designer Pro [wc-designer-pro]

Researcher

More Details >

WPC Shop as a Customer for WooCommerce <= 2.0.0 – Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-95687
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

WPC Shop as a Customer for WooCommerce [wpc-shop-as-customer]

Researcher

More Details >

Booking Activities <= 1.18.7.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-97248
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Booking Activities [booking-activities]

Researcher

More Details >

Haaken <= 1.5 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-104747
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Haaken – Fashion Store WordPress Theme [haaken]

Researcher

More Details >

Nelio Content <= 4.5.0 – Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via ‘id’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-94505
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Nelio Content – Editorial Calendar & Social Media Auto-Posting [nelio-content]

Researcher

More Details >

Ninja Forms – File Uploads <= 3.3.34 – Unauthenticated Arbitrary File Upload

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-92820
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Ninja Forms – File Uploads [ninja-forms-uploads]

Researcher

More Details >

Photo Reviews for WooCommerce <= 1.2.30 – Missing Authorization to Unauthenticated Arbitrary Post Deletion via ‘wcpr_image_upload_id’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-101923
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Photo Reviews for WooCommerce [woo-photo-reviews]

Researcher

More Details >

Super Forms <= 6.3.316 – Authenticated (Subscriber+) Arbitrary File/Directory Deletion via ‘subdir’ / ‘path’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-15983
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

More Details >

The Events Calendar <= 6.17.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-95606
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researcher

More Details >

WEBO MCP <= 3.0.18 – Authenticated (Author+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-97242
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

WEBO MCP [webo-mcp]

Researcher

More Details >

Advanced Post Manager <= 4.5.5 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-97283
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Advanced Post Manager [advanced-post-manager]

Researcher

More Details >

Ajax Search Pro <= 4.29.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96331
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Ajax Search Pro [ajax-search-pro]

Researcher

More Details >

Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96822
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Books Gallery – Book Showcase, Library & Affiliate Plugin [wp-books-gallery]

Researcher

More Details >

DesignSetGo <= 2.8.0 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94683
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

DesignSetGo [designsetgo]

Researcher

More Details >

eCommerce Product Catalog <= 3.6.0 – Authenticated (Custom Role+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96344
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

eCommerce Product Catalog [ecommerce-product-catalog]

Researcher

More Details >

EduAdmin Booking < 6.0.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96809
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

EduAdmin Booking [eduadmin-booking]

Researcher

More Details >

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 – Authenticated (Custom Role+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96343
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]

Researcher

More Details >

EWWW Image Optimizer 8.6.0 – 8.7.7 – Authenticated (Author+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-91051
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

EWWW Image Optimizer [ewww-image-optimizer]

Researcher

More Details >

Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export <= 3.0 – Authenticated (Custom Role+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-103348
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export [wp-ultimate-exporter]

Researcher

More Details >

Generate PDF using Contact Form 7 <= 4.2.1 – Unauthenticated Arbitrary File Read

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94666
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7]

Researcher

More Details >

GeoDirectory <= 2.8.186 – Unauthenticated SQL Injection via ‘latitude’ Parameter via Stored Pending Listing

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-103913
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

More Details >

Icegram Engage – Popups, Optins, CTAs & Lead Generation <= 3.1.31 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-97284
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Icegram Engage – Popups, Optins, CTAs & Lead Generation [icegram]

Researcher

More Details >

Iptanus File Upload <= 5.1.10 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-62071
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Iptanus File Upload [wp-file-upload]

Researcher

More Details >

JNews – Pay Writer <= 12.0.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96328
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

JNews – Pay Writer [jnews-pay-writer]

Researcher

More Details >

LearnPress <= 4.4.8 – Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via ‘item_id’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93882
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

Minimum and Maximum Quantity for WooCommerce <= 2.1.2 – Authenticated (Author+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93651
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Minimum and Maximum Quantity for WooCommerce [min-and-max-quantity-for-woocommerce]

Researcher

More Details >

Motors <= 1.4.109 – Unauthenticated Blind SQL Injection via ‘stm_lat’/’stm_lng’ Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-6806
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Nested Pages <= 3.3.2 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-100512
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Nested Pages [wp-nested-pages]

Researcher

More Details >

OMGF <= 6.3.10 – Denial of Service to Unauthenticated Site Availability Exhaustion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-91828
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. [host-webfonts-local]

Researcher

More Details >

Paytm Payment Gateway <= 2.8.8 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-81809
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Paytm Payment Gateway [paytm-payments]

Researcher

More Details >

PDF for Contact Form 7 + Drag and Drop Template Builder <= 7.1.0 – Unauthenticated Arbitrary File Read

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94664
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

PDF for Contact Form 7 + Drag and Drop Template Builder [pdf-for-contact-form-7]

Researcher

More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.46 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-102377
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Pro Like Button <= 1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89296
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Pro Like Button [prolike-button]

Researcher

More Details >

Product Designer App <= 1.1.3 – Unauthenticated Arbitrary File Read via ‘svg’ Parameter in pdapp-render-design

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-75098
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

Product Designer App [product-designer-app]

Researcher

More Details >

SaveTo Wishlist Lite <= 1.1.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89236
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

SaveTo Wishlist Lite – WooCommerce Wishlist [saveto-wishlist-lite-for-woocommerce]

Researcher

More Details >

Schema & Structured Data for WP & AMP <= 1.66 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-97291
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

Simple Event Planner <= 1.5.7 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-97257
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Simple Event Planner [simple-event-planner]

Researcher

More Details >

Simple Membership <= 4.8.3 – Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via ’email’ Parameter on Activation Endpoints

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-97337
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

More Details >

Simply Schedule Appointments <= 1.6.12.27 – Authenticated (Subscriber+) Local File Inclusion via ‘ssa_locale’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89294
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

More Details >

Simply Schedule Appointments <= 1.6.12.32 – Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via ‘recursive’ Parameter on the appointment_types REST Endpoint via Public Nonce

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-92245
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

More Details >

SiteOrigin Widgets Bundle <= 1.73.2 – Authenticated (Contributor+) Local File Inclusion via ‘theme’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-92174
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

SiteOrigin Widgets Bundle [so-widgets-bundle]

Researcher

More Details >

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.1 – Authenticated (Custom Role+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93617
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]

Researcher

More Details >

tagDiv Opt-In Builder <= 1.7.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96330
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

tagDiv Opt-In Builder [td-subscription]

Researcher

More Details >

Themify Builder <= 7.8.1 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96831
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Themify Builder [themify-builder]

Researcher

More Details >

Two Factor <= 0.16.0 – Unauthenticated Denial of Service

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-100508
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Two Factor [two-factor]

Researcher

More Details >

Ultimate Member <= 2.13.1 – Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93428
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

Unlimited Elements for Elementor <= 2.0.19 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-95534
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Unlimited Elements for Elementor <= 2.0.20 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-103355
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Unlimited Elements For Elementor 1.5.139 – 2.0.20 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-85568
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

VK Google Job Posting Manager <= 1.3.1 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-100511
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

VK Google Job Posting Manager [vk-google-job-posting-manager]

Researcher

More Details >

WooCommerce Appointments <= 5.3.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-32557
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

WooCommerce Appointments [woocommerce-appointments]

Researcher

More Details >

WooCommerce Lottery <= 2.2.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-32580
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

WooCommerce Lottery [wc-lottery]

Researcher

More Details >

WP BASE Booking of Appointments, Services and Events <= 6.4.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-103352
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]

Researcher

More Details >

WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.82 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-95605
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps [wp-data-access]

Researcher

More Details >

WP Spell Check <= 12.1 – Authenticated (Author+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-100506
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

WP Spell Check [wp-spell-check]

Researcher

More Details >

WP Visitor Statistics (Real Time Traffic) <= 8.7 – Unauthenticated SQL Injection via ‘fullRef’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-96267
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WP Visitor Statistics (Real Time Traffic) [wp-stats-manager]

Researcher

More Details >

WPBot – ChatBot Conversational Forms <= 1.5.0 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-95531
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

WPBot – ChatBot Conversational Forms [conversational-forms]

Researcher

More Details >

WPCafe <= 3.0.18 – Authenticated (Contributor+) Local File Inclusion via ‘food_menu_style’ Elementor Widget Setting

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-75028
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

More Details >

Aculect AI Companion <= 0.8.2 – Missing Authorization to Unauthorized Redirects

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-39600
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

Aculect AI Companion [aculect-ai-companion]

Researcher

More Details >

Authorizer <= 3.15.3 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-103752
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Authorizer [authorizer]

Researcher

More Details >

FluentCart <= 1.6.4 – Unauthenticated Unauthorized Customer Account Access

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-100143
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler [fluent-cart]

Researcher

More Details >

hCaptcha for WP <= 5.3.0 – Unauthenticated Captcha Verification Bypass

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-103347
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

hCaptcha for WP [hcaptcha-for-forms-and-more]

Researcher

More Details >

User Frontend 3.5.29 – 4.3.11 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-75823
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

More Details >

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.20 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-103085
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]

Researcher

More Details >

AI Engine <= 3.8.0 – Unauthenticated Stored Cross-Site Scripting via ‘model_’ Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96561
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

More Details >

All in One Files Upload for WooCommerce 2.0.3 – 2.0.16 – Unauthenticated Stored Cross-Site Scripting via SVG Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85573
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

All in One Files Upload for WooCommerce [all-in-one-files-upload-for-woocommerce]

Researcher

More Details >

Appointment Hour Booking <= 1.5.97 – Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96573
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Appointment Hour Booking – Booking Calendar [appointment-hour-booking]

Researcher

More Details >

Astra <= 4.13.12 – Authenticated (Shop Manager+) Arbitrary CSS Injection

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-27085
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Astra [astra]

Researcher

More Details >

Autoptimize <= 3.1.15.1 – Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-14995
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Autoptimize [autoptimize]

Researcher

More Details >

BA Book Everything <= 1.8.28 – Unauthenticated Stored Cross-Site Scripting via ‘booking_service_qty’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102565
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

BA Book Everything [ba-book-everything]

Researcher

More Details >

Betheme <= 28.5.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94415
Patch Status

Unpatched
Published
Oct 3, 2026

Affected Software

Betheme [betheme]

Researcher

More Details >

BlockStrap Page Builder – Bootstrap Blocks <= 0.1.58 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94632
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

BlockStrap Page Builder – Bootstrap Blocks [blockstrap-page-builder-blocks]

Researcher

More Details >

Broken Link Notifier 1.3.1 – 2.0.0 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97316
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Broken Link Notifier [broken-link-notifier]

Researcher

More Details >

Business Essentials for Contact Form 7 <= 1.2.1 – Unauthenticated Stored Cross-Site Scripting via ‘gateway’ Form Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97661
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Business Essentials for Contact Form 7 [cf7-redirect-thank-you-page]

Researcher

More Details >

Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96351
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]

Researcher

More Details >

CMB2 <= 2.13.0 – Unauthenticated Stored Cross-Site Scripting via ‘file_list’ Field Type

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97336
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

CMB2 [cmb2]

Researcher

More Details >

CMB2 <= 2.13.1 – Unauthenticated Stored Cross-Site Scripting via ‘textarea_code’ Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102772
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

CMB2 [cmb2]

Researcher

More Details >

CTX Feed Pro <= 7.6.12 – Authenticated (Administrator+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-10026
Patch Status

Unpatched
Published
Oct 1, 2026

Affected Software

CTX Feed Pro [webappick-product-feed-for-woocommerce-pro]

Researchers

More Details >

CURCY – Multi Currency for WooCommerce 2.2.18 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94171
Patch Status

Unpatched
Published
Sep 30, 2026

Affected Software

CURCY – Multi Currency for WooCommerce [woo-multi-currency]

Researcher

More Details >

Customer Reviews for WooCommerce <= 5.122.0 – Unauthenticated Stored Cross-Site Scripting via Comment Author Name

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97663
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Customer Reviews for WooCommerce [customer-reviews-woocommerce]

Researcher

More Details >

DoFollow Case by Case <= 3.6.0 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95817
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

DoFollow Case by Case [dofollow-case-by-case]

Researcher

More Details >

Download Monitor <= 5.2.10 – Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-100182
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Download Monitor [download-monitor]

Researcher

More Details >

Easy Google Maps <= 1.14.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102395
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Easy Google Maps [google-maps-easy]

Researcher

More Details >

Extendify <= 3.1.6 – Unauthenticated Stored Cross-Site Scripting via ‘styles.blocks’ Block Type Key

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85679
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Extendify [extendify]

Researcher

More Details >

Form Maker by 10Web <= 1.15.47 – Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96813
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

More Details >

Forminator Forms <= 1.57.2 – Unauthenticated Stored Cross-Site Scripting via ‘postdata-1[post-custom]’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92144
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Forminator Forms <= 1.57.2 – Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85235
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Frontend File Manager Plugin <= 23.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-32577
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Frontend File Manager Plugin [nmedia-user-file-uploader]

Researcher

More Details >

Frontend Post Submission Manager Lite <= 1.3.4 – Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96649
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms [frontend-post-submission-manager-lite]

Researcher

More Details >

GD Rating System <= 3.7.1 – Unauthenticated Stored Cross-Site Scripting via ‘title’ and ‘url’ Render Args in gdrts_live_handler AJAX

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93430
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

GD Rating System [gd-rating-system]

Researcher

More Details >

Geo Mashup <= 1.13.21 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97250
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Geo Mashup [geo-mashup]

Researcher

More Details >

GSpeech TTS <= 3.22.0 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96578
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

GSpeech TTS – WordPress Text To Speech Plugin [gspeech]

Researcher

More Details >

HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96326
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

HT Contact Form – Drag & Drop Form Builder for WordPress [ht-contactform]

Researcher

More Details >

If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-100507
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]

Researcher

More Details >

JetAppointment <= 2.5.2.1 – Unauthenticated Stored Cross-Site Scripting via ‘friendlyTime’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93875
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

JetAppointment [jet-appointments-booking]

Researcher

More Details >

JetBlog <= 2.4.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94661
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

JetBlog [jet-blog]

Researcher

More Details >

JetEngine <= 3.8.15.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97265
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.5.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102391
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

JetFormBuilder <= 3.6.5.4 – Unauthenticated Stored Cross-Site Scripting via ‘choice’ Post Meta via Insert/Update Post Action

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97342
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

JW Player for WordPress <= 2.3.11 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93512
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

JW Player for WordPress [jw-player-7-for-wp]

Researcher

More Details >

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.11.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-103354
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

More Details >

Kubio AI Page Builder <= 2.9.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88783
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Kubio AI Page Builder [kubio]

Researcher

More Details >

Kubio AI Page Builder <= 2.9.2 – Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-100107
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Kubio AI Page Builder [kubio]

Researcher

More Details >

Kubio AI Page Builder <= 2.9.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94167
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Kubio AI Page Builder [kubio]

Researcher

More Details >

Magic Tooltips For Contact Form 7 <= 1.0.34 – Unauthenticated Stored Cross-Site Scripting via ‘esc_html’ Filter Override via Comment Author

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-101928
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Magic Tooltips For Contact Form 7 [magic-tooltips-for-contact-form-7]

Researcher

More Details >

Mail logging <= 2.1.12 – Unauthenticated Stored Cross-Site Scripting via PHPMailer ‘wp_mail_failed’ Error Message

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93889
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Mail logging & Catcher [wp-mail-catcher]

Researcher

More Details >

Mang Board <= 2.4.2 – Unauthenticated Stored Cross-Site Scripting via ‘data_type’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96871
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Mang Board [mangboard]

Researcher

More Details >

MaxGalleria <= 6.5.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97260
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

MaxGalleria [maxgalleria]

Researcher

More Details >

Media Library Assistant <= 3.41 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95609
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

MW WP Form <= 5.1.7 – Unauthenticated Stored Cross-Site Scripting via ‘post_id’ Parameter (via stored form-submitted post meta)

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96567
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

MW WP Form [mw-wp-form]

Researcher

More Details >

Newsletter <= 9.4.0 – Unauthenticated Stored Cross-Site Scripting via ‘np1’ Custom Field Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96566
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Newsletter – Send awesome emails from WordPress

Researcher

More Details >

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102385
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]

Researcher

More Details >

Ninja Forms <= 3.15.4 – Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90438
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

No External Links <= 5.2.0 – Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95670
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

No External Links [mihdan-no-external-links]

Researcher

More Details >

Notification for Telegram <= 3.5.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93514
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Notification for Telegram [notification-for-telegram]

Researcher

More Details >

Parallax Section Block – Add Parallax Scrolling Effects to Sections <= 2.0.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102378
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Parallax Section Block – Add Parallax Scrolling Effects to Sections [parallax-section]

Researcher

More Details >

Paytm Payment Gateway <= 2.8.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81739
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Paytm Payment Gateway [paytm-payments]

Researcher

More Details >

PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 – Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92244
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips]

Researcher

More Details >

PDF Smart Viewer for Elementor <= 1.0.4 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39719
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

PDF Smart Viewer for Elementor [pdf-smart-viewer-for-elementor]

Researcher

More Details >

Persistent Login <= 3.1.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94081
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Persistent Login [wp-persistent-login]

Researcher

More Details >

Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97290
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Photonic Gallery & Lightbox for Flickr, SmugMug & Others [photonic]

Researcher

More Details >

Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.14 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-100510
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Post and Page Builder by BoldGrid – Visual Drag and Drop Editor [post-and-page-builder]

Researcher

More Details >

Post Views Stats Counter <= 1.1.7 – Unauthenticated Stored Cross-Site Scripting via User-Agent Header

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97347
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

Post Views Stats Counter [post-views-stats-counter]

Researcher

More Details >

Premmerce Permalink Manager for WooCommerce <= 2.3.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97272
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Premmerce Permalink Manager for WooCommerce [woo-permalink-manager]

Researcher

More Details >

Premmerce Wishlist for WooCommerce <= 1.1.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97273
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Premmerce Wishlist for WooCommerce [premmerce-woocommerce-wishlist]

Researcher

More Details >

Premmerce Wishlist for WooCommerce <= 1.1.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97268
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Premmerce Wishlist for WooCommerce [premmerce-woocommerce-wishlist]

Researcher

More Details >

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97289
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

More Details >

Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 – Unauthenticated Stored Cross-Site Scripting via Comment

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92977
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Real Cookie Banner: GDPR & ePrivacy Cookie Consent [real-cookie-banner]

Researcher

More Details >

Relevanssi <= 4.28.3 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97641
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Relevanssi – A Better Search [relevanssi]

Researcher

More Details >

Relevanssi Premium <= 2.31.4 – Unauthenticated Stored Cross-Site Scripting via ‘_rt’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-103426
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Relevanssi Premium [relevanssi-premium]

Researcher

More Details >

Robin Image Optimizer 2.0.0 – 2.0.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-89193
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF [robin-image-optimizer]

Researcher

More Details >

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94668
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]

Researcher

More Details >

Search in Place <= 1.5.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95598
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Search in Place [search-in-place]

Researcher

More Details >

SEOPress <= 10.2 – Unauthenticated Stored Cross-Site Scripting via Author Display Name

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96564
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]

Researcher

More Details >

ShopBuilder – WooCommerce Builder For Elementor <= 3.4.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95596
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

ShopBuilder – WooCommerce Builder For Elementor [shopbuilder]

Researcher

More Details >

Simple Payment <= 2.5.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96332
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Simple Payment [simple-payment]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

Smart Forms – when you need more than just a contact form <= 2.6.104 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-32574
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Smart Forms – when you need more than just a contact form [smart-forms]

Researcher

More Details >

Smart Popup by Supsystic <= 1.13.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102398
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Smart Popup by Supsystic [popup-by-supsystic]

Researcher

More Details >

Smash Balloon Social Post Feed <= 4.13.0 – Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93756
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed]

Researcher

More Details >

Social Sharing Plugin – Sassy Social Share <= 3.3.79 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94170
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Social Sharing Plugin – Sassy Social Share [sassy-social-share]

Researcher

More Details >

Strong Testimonials <= 3.3.11 – Unauthenticated Stored Cross-Site Scripting via ‘platform_user_photo’ Custom Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96650
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Strong Testimonials [strong-testimonials]

Researcher

More Details >

SUMO Affiliates Pro <= 11.7.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-32575
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

SUMO Affiliates Pro [affs]

Researcher

More Details >

Total Donations <= 2.0.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94159
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Total Donations [totaldonations]

Researcher

More Details >

TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-103062
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]

Researcher

More Details >

Transliterator <= 2.5.8 – Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96575
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Transliterator – Multilingual and Multi-script Text Conversion [serbian-transliteration]

Researcher

More Details >

Trusted Shops Easy Integration for WooCommerce <= 2.0.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96816
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Trusted Shops Easy Integration for WooCommerce [trusted-shops-easy-integration-for-woocommerce]

Researcher

More Details >

Ultimate Maps by Supsystic <= 1.5.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-102396
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]

Researcher

More Details >

Ultimate Member <= 2.13.1 – Unauthenticated Stored Cross-Site Scripting via ‘form_id’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96270
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

Ultimate Review <= 2.4.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-101159
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP Ultimate Review [wp-ultimate-review]

Researcher

More Details >

Unlimited Elements for Elementor <= 2.0.19 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94662
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.20 – Authenticated (Admin+) Arbitrary File Write

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85015
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

UpSolution Core <= 8.44 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94166
Patch Status

Unpatched
Published
Oct 3, 2026

Affected Software

UpSolution Core [us-core]

Researcher

More Details >

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94641
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp]

Researcher

More Details >

Verge3D <= 4.13.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92994
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Verge3D Publishing and E-Commerce [verge3d]

Researcher

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.14 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95591
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

Visitor Traffic Real Time Statistics <= 8.16 – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘X-Real-IP’ HTTP Header

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97341
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Visitor Traffic Real Time Statistics [visitors-traffic-real-time-statistics]

Researcher

More Details >

Visitors Traffic Real Time Statistics Pro <= 11.22 – Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93367
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Visitor Traffic Real Time Statistics pro [visitors-traffic-real-time-statistics-pro]

Researcher

More Details >

W3 Total Cache <= 2.10.6 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87920
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

More Details >

Welcart e-Commerce <= 2.12.2 – Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87091
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Welcart e-Commerce [usc-e-shop]

Researcher

More Details >

Welcart e-Commerce <= 2.12.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96761
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Welcart e-Commerce [usc-e-shop]

Researcher

More Details >

WP Media folder <= 6.2.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-32569
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

WP Media folder [wp-media-folder]

Researcher

More Details >

WP User Frontend Pro <= 4.2.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-32572
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

WP User Frontend Pro [wp-user-frontend-pro]

Researcher

More Details >

WPC Product Options for WooCommerce <= 4.0.5 – Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97660
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WPC Product Options for WooCommerce [wpc-product-options]

Researcher

More Details >

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97271
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

More Details >

Prime Mover – Backup and Migration <= 2.2.0 – Authenticated (Admin+) Arbitrary Directory Deletion

7.1

CVSS Rating
7.1 (High)
CVE-ID

CVE-2026-101889
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Prime Mover – Backup and Migration [prime-mover]

Researcher

More Details >

Content Egg – Affiliate Product Importer & Price Comparison <= 6.3.1 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-96832
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Content Egg – Affiliate Product Importer & Price Comparison [content-egg]

Researcher

More Details >

Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 3.5.2 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-93771
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Cost of Goods: Product Cost & Profit Calculator for WooCommerce [cost-of-goods-for-woocommerce]

Researcher

More Details >

Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-102392
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Extra Product Options For WooCommerce | Custom Product Addons and Fields [woo-extra-product-options]

Researcher

More Details >

Hide Shipping Method For WooCommerce <= 1.5.4 – Authenticated (Editor+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-94390
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Hide Shipping Method For WooCommerce [hide-shipping-method-for-woocommerce]

Researcher

More Details >

Music Player for WooCommerce <= 1.9.1 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-93624
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Music Player for WooCommerce [music-player-for-woocommerce]

Researcher

More Details >

Page Builder by SiteOrigin <= 2.36.0 – Authenticated (Editor+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-97256
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Page Builder by SiteOrigin [siteorigin-panels]

Researcher

More Details >

Pay with Vipps and MobilePay for WooCommerce <= 6.2.0 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-94568
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Pay with Vipps and MobilePay for WooCommerce [woo-vipps]

Researcher

More Details >

Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.7 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-103349
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce [woo-product-feed-pro]

Researcher

More Details >

Responsive Slider Gallery – Responsive Image Photo Slider <= 1.5.5 – Authenticated (Editor+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-94122
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Responsive Slider Gallery – Responsive Image Photo Slider [responsive-slider-gallery]

Researcher

More Details >

All in One SEO <= 5.0.2 – Unauthenticated Arbitrary Shortcode Execution via ‘s’ Search Query Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-100152
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack]

Researcher

More Details >

All in One SEO <= 5.0.2.0 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-19856
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack]

Researcher

More Details >

Beaver Builder Page Builder <= 2.11.0.5 – Authenticated (Contributor+) SQL Injection via ‘fields[][value]’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-95865
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]

Researcher

More Details >

BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-102379
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder]

Researcher

More Details >

BuildKit <= 1.0.28 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-94298
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder]

Researcher

More Details >

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 – Authenticated (Contributor+) Path Traversal

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-97244
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms]

Researcher

More Details >

Event Tickets and Registration <= 5.29.5 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-97287
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Event Tickets and Registration <= 5.29.5 – Authenticated (Contributor+) SQL Injection via ‘orderby’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-97634
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Media Library Assistant <= 3.41 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-97293
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Mooberry Book Manager 4.16.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-32581
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Mooberry Book Manager [mooberry-book-manager]

Researcher

More Details >

MultiVendorX <= 5.0.18 – Authenticated (Store Manager+) SQL Injection via ‘order_by’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12951
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

More Details >

Pricing Table WordPress Plugin – Easy Pricing Tables <= 4.1.2 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-94115
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Pricing Table WordPress Plugin – Easy Pricing Tables [easy-pricing-tables]

Researcher

More Details >

ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-94663
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]

Researcher

More Details >

Quiz Cat – WordPress Quiz Plugin <= 3.1.1 – Authenticated (Author+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-94082
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Quiz Cat – WordPress Quiz Plugin [quiz-cat]

Researcher

More Details >

Simply Schedule Appointments <= 1.6.12.31 – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via ‘complete_group’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-91109
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

More Details >

SupportCandy <= 3.5.3 – Authenticated (Custom+) SQL Injection via ‘sort_by’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-94539
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy]

Researcher

More Details >

tagDiv Opt-In Builder <= 1.7.6 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-96329
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

tagDiv Opt-In Builder [td-subscription]

Researcher

More Details >

Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 6.0.5 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-95599
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Taskbuilder – Project Management & Task Management Tool With Kanban Board [taskbuilder]

Researcher

More Details >

The Events Calendar 6.12.0 – 6.17.5 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-84740
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researcher

More Details >

Unlimited Elements for Elementor <= 2.0.20 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-103338
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Unlimited Elements For Elementor 1.5.142 – 2.0.20 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-92923
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

WP BASE Booking of Appointments, Services and Events <= 6.4.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-103066
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]

Researcher

More Details >

WP Directory Kit <= 1.5.4 – Authenticated (Custom+) SQL Injection via ‘data_fields_list’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-16596
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

More Details >

WP Ultimate Review <= 2.4.3 – Unauthenticated Arbitrary Shortcode Execution via ‘xs_reviw_summery’ Parameter (Split-Shortcode / Late-Registered Shortcode)

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-100157
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WP Ultimate Review [wp-ultimate-review]

Researcher

More Details >

Audio Player Block 1.1.0 – 1.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85415
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Audio Player Block – Advanced Block for Embedding Audio Files [audio-player-block]

Researcher

More Details >

Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.9 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96820
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]

Researcher

More Details >

Awesome Support <= 6.4.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘gdpr-data’ Parameter via wpas_gdpr_user_opt_out AJAX Action

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96268
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]

Researcher

More Details >

bbp style pack <= 6.4.8 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-101925
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

bbp style pack [bbp-style-pack]

Researcher

More Details >

Bold Page Builder <= 5.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘background_image’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6173
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Bold Page Builder [bold-page-builder]

Researcher

More Details >

Bold Page Builder <= 5.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘caption’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6172
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Bold Page Builder [bold-page-builder]

Researcher

More Details >

Bold Page Builder <= 5.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘target’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6171
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Bold Page Builder [bold-page-builder]

Researcher

More Details >

Bold Page Builder <= 5.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid ‘images’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6170
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Bold Page Builder [bold-page-builder]

Researcher

More Details >

Bold Page Builder <= 5.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-88037
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Bold Page Builder [bold-page-builder]

Researcher

More Details >

Branda – White Label & Branding, Free Login Page Customizer <= 3.4.32 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102376
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Branda – White Label & Branding, Free Login Page Customizer [branda-white-labeling]

Researcher

More Details >

CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-100513
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

CF7 Views – Complete Entry Management for Contact Form 7 [cf7-views]

Researcher

More Details >

Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94665
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]

Researcher

More Details >

CMB2 <= 2.13.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97270
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

CMB2 [cmb2]

Researcher

More Details >

Content Egg <= 11.8.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-92424
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Content Egg – Affiliate Product Importer & Price Comparison [content-egg]

Researcher

More Details >

Cool FormKit Lite – Advanced Form Builder for Elementor <= 2.7.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97301
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Cool FormKit Lite – Advanced Form Builder for Elementor [extensions-for-elementor-form]

Researcher

More Details >

Download Manager <= 3.3.70 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86610
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Download Manager [downloadmanager]

Researcher

More Details >

Download Manager <= 3.3.70 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97338
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Duplicate Post <= 1.5.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘noti_token’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-89424
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Duplicate Post [copy-delete-posts]

Researcher

More Details >

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103064
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite]

Researcher

More Details >

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103063
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite]

Researcher

More Details >

EmbedPress <= 4.6.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘slidesShow’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-92727
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

EmbedPress 4.4.9 – 4.6.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85001
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress]

Researcher

More Details >

Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102394
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

More Details >

EWWW Image Optimizer <= 8.7.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97067
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

EWWW Image Optimizer [ewww-image-optimizer]

Researcher

More Details >

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103343
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

More Details >

Gutenberg Essential Blocks <= 6.4.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘marker’ Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96256
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks]

Researcher

More Details >

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.23.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62080
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]

Researcher

More Details >

Horizontal Scrolling Announcements <= 2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-17005
Patch Status

Unpatched
Published
Oct 1, 2026

Affected Software

Horizontal scrolling announcements [horizontal-scrolling-announcements]

Researcher

More Details >

Hostinger Reach 1.0.6 – 1.8.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-87777
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Hostinger Reach – AI-Powered Email Marketing for WordPress [hostinger-reach]

Researcher

More Details >

HT Mega Addons for Elementor <= 3.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table ‘display_options’ Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11895
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]

Researcher

More Details >

JetReviews <= 3.1.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94667
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

JetReviews [jet-reviews]

Researcher

More Details >

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.86 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97298
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

Kubio AI Page Builder <= 2.9.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-88782
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Kubio AI Page Builder [kubio]

Researcher

More Details >

LA-Studio Element Kit for Elementor <= 1.6.2 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103082
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

LA-Studio Element Kit for Elementor [lastudio-element-kit]

Researcher

More Details >

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘lsd[remark]’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96647
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom]

Researcher

More Details >

Loco Translate <= 2.8.8 – Authenticated (Translator+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94239
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Loco Translate [loco-translate]

Researcher

More Details >

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-103339
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform]

Researcher

More Details >

Motors <= 1.4.123 – Authenticated (Listing Manager+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-91022
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96607
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

Ohio Extra <= 3.6.8 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-32571
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Ohio Extra [ohio-extra]

Researcher

More Details >

oik <= 4.15.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96819
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

oik [oik]

Researcher

More Details >

Pixfort Core < 4.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96450
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Pixfort Core [pixfort-core]

Researcher

More Details >

Polylang <= 3.8.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97279
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Polylang [polylang]

Researcher

More Details >

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62078
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]

Researcher

More Details >

Qi Addons For Elementor <= 1.11 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62079
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Qi Addons For Elementor [qi-addons-for-elementor]

Researcher

More Details >

ReactPress <= 3.4.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘permalink’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-92712
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

ReactPress – Create React App for WordPress [reactpress]

Researcher

More Details >

Real Estate Manager <= 7.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘before_price_text’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-93908
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

Real Estate Manager – Property Listing and Agent Management [real-estate-manager]

Researcher

More Details >

Redux Framework <= 4.5.14 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘user-mediaurl’ Media Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-90992
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

More Details >

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1225 – Authenticated (Customer+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-100509
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]

Researcher

More Details >

Responsive Plus <= 3.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15795
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Responsive Starter Templates – Elementor Templates & Starter Sites [responsive-add-ons]

Researcher

More Details >

Rich Showcase for Google Reviews <= 7.1.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-100148
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Rich Showcase for Google Reviews [widget-google-reviews]

Researcher

More Details >

Smart Slider 3 <= 3.5.1.38 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘data-href’ Attribute in Custom HTML Block

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14876
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Smart Slider 3 [smart-slider-3]

Researcher

More Details >

Strong Testimonials <= 3.3.11 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97286
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Strong Testimonials [strong-testimonials]

Researcher

More Details >

SupportCandy <= 3.5.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘name’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94378
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy]

Researcher

More Details >

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.63 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102384
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder [supreme-modules-for-divi]

Researcher

More Details >

ThemeREX Addons <= 2.46.0 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102797
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

ThemeREX Addons [trx_addons]

Researcher

More Details >

ThemeREX Addons <= 2.46.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102798
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

ThemeREX Addons [trx_addons]

Researcher

More Details >

Twenty20 Image Before-After <= 2.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘offset’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-92767
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Twenty20 Image Before-After [twenty20]

Researcher

More Details >

Ultimate Review <= 2.4.3 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-101162
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP Ultimate Review [wp-ultimate-review]

Researcher

More Details >

Ultra Addons Lite for Elementor <= 1.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-12828
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Ultra Addons Lite for Elementor [ut-elementor-addons-lite]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.20 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85016
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20260810 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62084
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

User Submitted Posts – Enable Users to Submit Posts from the Front End [user-submitted-posts]

Researcher

More Details >

Viable URL Media Uploader <= 1.0.0 – Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-14564
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

Viable URL Media Uploader [viable-url-media-uploader]

Researcher

More Details >

Virtue Premium <= 4.10.21 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Virtue Premium [virtue_premium]

Researcher

More Details >

Virtue Premium <= 4.10.22 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Virtue Premium [virtue_premium]

Researcher

More Details >

Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97266
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Virtue/Ascend/Pinnacle Toolkit [virtue-toolkit]

Researcher

More Details >

Visual Composer Website Builder <= 45.16.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97262
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Visual Composer Website Builder [visualcomposer]

Researcher

More Details >

WP OAuth Server (OAuth Authentication) <= 4.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97288
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

WP OAuth Server (OAuth Authentication) [oauth2-provider]

Researcher

More Details >

WP Photo Album Plus <= 9.3.02.003 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-102386
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

Wp Social Login and Register Social Counter <= 3.2.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97344
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Wp Social Login and Register Social Counter [wp-social]

Researcher

More Details >

YITH WooCommerce Tab Manager <= 2.15.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97292
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

YITH WooCommerce Tab Manager [yith-woocommerce-tab-manager]

Researcher

More Details >

ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-103068
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

ByteCoreStack – MCP Connector for AI Tools [bcs-mcp-manager]

Researcher

More Details >

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 – Authenticated (Subscriber+) Free Paid Course Enrollment

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-62083
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms]

Researcher

More Details >

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.0.12 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-96821
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

More Details >

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-96451
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

Vitepos – Point of Sale (POS) for WooCommerce <= 3.5.0 – Authenticated (Custom Role+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-96815
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]

Researcher

More Details >

Ad Inserter <= 2.8.18 – Reflected Cross-Site Scripting via ‘s’ Search Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-89427
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

Ad Inserter <= 2.8.18 – Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-19902
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

All in One SEO <= 5.0.1.1 – Reflected DOM-Based Cross-Site Scripting via URL Pathname

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-85492
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack]

Researcher

More Details >

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 – Reflected Cross-Site Scripting via ‘lang’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-84925
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Avada | Website Builder For WordPress & WooCommerce [Avada]

Researcher

More Details >

Calculated Fields Form <= 5.5.1.3 – Reflected DOM-Based Cross-Site Scripting via ‘x’ URL Parameter via setChoices()

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-100179
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

Calculated Fields Form <= 5.5.1.5 – Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-103909
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

Disable and Remove Google Fonts | GDPR & DSGVO friendly <= 2.0.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-95595
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Disable and Remove Google Fonts | GDPR & DSGVO friendly [disable-remove-google-fonts]

Researcher

More Details >

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94670
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms]

Researcher

More Details >

EWWW Image Optimizer <= 8.7.7 – Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92826
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

EWWW Image Optimizer [ewww-image-optimizer]

Researcher

More Details >

Five Star Restaurant Reviews <= 2.3.13 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92412
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Five Star Restaurant Reviews [good-reviews-wp]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

Grand Restaurant WordPress < 7.0.11 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-94161
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Grand Restaurant WordPress [grandrestaurant]

Researcher

More Details >

Greenshift <= 13.2.0 – Reflected Cross-Site Scripting via ‘{{GET:}}’ Dynamic Placeholder

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-93880
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]

Researcher

More Details >

If-So Dynamic Content 1.8 – 1.10.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-87970
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]

Researcher

More Details >

Ivory Search <= 5.5.18 – Reflected DOM-Based Cross-Site Scripting via ‘s’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92243
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Ivory Search – WordPress Search Plugin [add-search-to-menu]

Researcher

More Details >

LearnPress <= 4.4.7 – Reflected DOM-Based Cross-Site Scripting via ‘orderby’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92538
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

Mobile Menu 2.7.4 – 2.8.8 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-91832
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

WP Mobile Menu – The Mobile-Friendly Responsive Menu [mobile-menu]

Researcher

More Details >

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 – Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92551
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

Payflex Payment Gateway <= 2.7.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-103346
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Payflex Payment Gateway [payflex-payment-gateway]

Researcher

More Details >

Photo Gallery by 10Web <= 1.8.46 – Reflected Cross-Site Scripting via ‘thumb_url’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92974
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Photo Reviews for WooCommerce <= 1.2.30 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-100515
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Photo Reviews for WooCommerce [woo-photo-reviews]

Researcher

More Details >

Progressify – Progressive Web App (PWA) <= 1.6.0 – Unauthenticated Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-32570
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Progressify – All-in-One Progressive Web App (PWA) [progressify]

Researcher

More Details >

Social Media Share Buttons & Social Sharing Icons <= 3.0.1 – Reflected DOM-Based Cross-Site Scripting via URL

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-89047
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons]

Researcher

More Details >

Unlimited Elements for Elementor <= 2.0.20 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-103344
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Unlimited Elements for Elementor <= 2.0.20 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-103342
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-97276
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics]

Researcher

More Details >

WP Statistics <= 14.16.14 – Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-97652
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics]

Researcher

More Details >

WPC Estimated Delivery Date for WooCommerce <= 4.0.1 – Reflected Cross-Site Scripting via ‘rule_data’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-104313
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WPC Estimated Delivery Date for WooCommerce [wpc-estimated-delivery-date]

Researcher

More Details >

WPC Smart Quick View for WooCommerce <= 4.4.0 – Reflected Cross-Site Scripting via ‘woosq-redirect’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-103888
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WPC Smart Quick View for WooCommerce [woo-smart-quick-view]

Researcher

More Details >

WPFront Notification Bar <= 3.5.1 – Reflected Cross-Site Scripting via REQUEST_URI

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-93896
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WPFront Notification Bar [wpfront-notification-bar]

Researcher

More Details >

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-27371
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

More Details >

Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 – Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-12241
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Advanced Woo Labels – Product Labels & Badges for WooCommerce [advanced-woo-labels]

Researcher

More Details >

Autoptimize <= 3.1.15.1 – Unauthenticated Stored Cross-Site Scripting via Comment Author Name

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-78471
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Autoptimize [autoptimize]

Researcher

More Details >

Jeg Kit for Elementor <= 3.2.19 – Unauthenticated Stored Cross-Site Scripting via Comment

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-100180
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.20 – Authenticated (Subscriber+) Arbitrary Shortcode Execution

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-92924
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

WP Ultimate Review <= 2.4.3 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘xs_reviw_summery’ Parameter

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-103519
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WP Ultimate Review [wp-ultimate-review]

Researcher

More Details >

WPMobile.App <= 11.84 – Unauthenticated Stored Cross-Site Scripting via ‘/android_json/search/<value>/0’ Path Segment

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-103421
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WPMobile.App – Android and iOS App Builder [wpappninja]

Researcher

More Details >

AFFI – Affiliate Marketing for WooCommerce <= 1.0.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-102390
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

AFFI – Affiliate Marketing for WooCommerce [affi-affiliate-marketing-for-woo]

Researcher

More Details >

Appointment Booking Plugin <= 5.7.1 – Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via ‘invoice_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94432
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researchers

More Details >

BackupEase – Scheduled Backup, Restore & Site Migration <= 2.2.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97241
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

BackupEase – Scheduled Backup, Restore & Site Migration [backupease]

Researcher

More Details >

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) <= 1.2.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95526
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) [woo-bulk-editor]

Researcher

More Details >

Booking Calendar <= 11.8.4 – Unauthenticated Duplicate Slot Booking

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39601
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 – Unauthenticated Cart Data Manipulation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97275
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder]

Researcher

1e008e2827556f92e4e1199ee59c1c4ddcs

More Details >

Bus Ticket Booking with Seat Reservation <= 5.9.3 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97251
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Bus Ticket Booking with Seat Reservation [bus-ticket-booking-with-seat-reservation]

Researcher

More Details >

CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 <= 3.7.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62058
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 [contact-form-7-honeypot]

Researcher

More Details >

CMP – Coming Soon & Maintenance <= 4.1.19 – Unauthenticated Maintenance Mode Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-13413
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]

Researcher

More Details >

Connections Business Directory <= 10.4.67 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86789
Patch Status

Unpatched
Published
Sep 28, 2026

Affected Software

Connections Business Directory [connections]

Researcher

More Details >

Cost Calculator Builder <= 4.0.17 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97307
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Cost Calculator Builder [cost-calculator-builder]

Researcher

More Details >

Course Booking System <= 7.0.8 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96886
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Course Booking System [course-booking-system]

Researchers

More Details >

Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.23 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97070
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates [cozy-addons]

Researcher

More Details >

Deema Payment Gateway <= 1.1.2 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94271
Patch Status

Unpatched
Published
Oct 3, 2026

Affected Software

Deema Payment Gateway [deema-payment-gateway]

Researcher

More Details >

Deema Payment Gateway <= 1.1.2 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94270
Patch Status

Unpatched
Published
Oct 3, 2026

Affected Software

Deema Payment Gateway [deema-payment-gateway]

Researchers

More Details >

Download Manager <= 3.3.70 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94405
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Easy PayPal & Stripe Buy Now Button 1.8 – 2.0.5 – Unauthenticated Arbitrary Payment Amount Reduction

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90987
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal]

Researcher

More Details >

Edit Password Protected 2.0.0 – 2.0.6 – Unauthenticated Access Mode Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90952
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

WPEPP – Essential Security, Password Protect & Login Page Customizer [wp-edit-password-protected]

Researcher

More Details >

elegro Crypto Payment <= 1.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94299
Patch Status

Unpatched
Published
Oct 3, 2026

Affected Software

elegro Crypto Payment [elegro-payment]

Researcher

More Details >

Fast Courier <= 5.2.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89289
Patch Status

Unpatched
Published
Oct 3, 2026

Affected Software

Fast Courier – Shipping & Freight [fast-courier-shipping-freight]

Researcher

More Details >

File Uploads Addon for WooCommerce <= 1.7.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-13607
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

File Uploads Addon for WooCommerce [woo-addon-uploads]

Researcher

More Details >

File Uploads Addon for WooCommerce 1.7.2 – 1.7.5 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78371
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

File Uploads Addon for WooCommerce [woo-addon-uploads]

Researcher

More Details >

Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.24 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103334
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Five Star Restaurant Reservations – WordPress Booking Plugin [restaurant-reservations]

Researcher

More Details >

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103353
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96335
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Fusion Lite 3.37.14 – 3.47.14 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90974
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

WP Fusion Lite – Marketing Automation and CRM Integration for WordPress [wp-fusion-lite]

Researcher

More Details >

Giveaways and Contests by RafflePress <= 1.12.26 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97317
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers [rafflepress]

Researcher

More Details >

GravityExport Lite for Gravity Forms <= 2.7.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94120
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

GravityExport Lite for Gravity Forms [gf-entries-in-excel]

Researcher

More Details >

Hostinger Migrator <= 1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95587
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Hostinger Migrator [migrator-plugin]

Researcher

More Details >

Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT <= 2.0.2 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97305
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT [hyve-lite]

Researcher

More Details >

InPost for WooCommerce 1.7.5 – 1.9.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-93580
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

InPost PL [inpost-for-woocommerce]

Researcher

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104403
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

Lookzy LookBook for WooCommerce <= 1.1.14 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-102383
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Lookzy LookBook for WooCommerce [woo-lookbook]

Researcher

More Details >

Mailchimp for WooCommerce <= 6.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92437
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Mailchimp for WooCommerce [mailchimp-for-woocommerce]

Researcher

More Details >

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-102381
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]

Researcher

More Details >

MetForm <= 4.3.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86832
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform]

Researcher

More Details >

MetForm 2.2.1 – 4.3.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86834
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform]

Researcher

More Details >

MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO <= 4.2.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97302
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]

Researcher

More Details >

New User Approve 3.1.0 – 3.2.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-83560
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

New User Approve [new-user-approve]

Researcher

More Details >

Newsletter <= 9.3.9 – Unauthenticated Insufficiently Protected Credentials via ‘/tnp/l/’ Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92537
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Newsletter – Send awesome emails from WordPress

Researcher

More Details >

Notivo Notification for WooCommerce <= 1.4.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97261
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Notivo Notification for WooCommerce [woo-notification]

Researcher

More Details >

OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 – Unauthenticated Authentication Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97274
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

OAuth Single Sign On – SSO (OAuth Client) [miniorange-login-with-eve-online-google-facebook]

Researcher

More Details >

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 – Unauthenticated Unauthorized Subscription Activation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97249
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

More Details >

Pay with Vipps and MobilePay for WooCommerce <= 6.2.4 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97259
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Pay with Vipps and MobilePay for WooCommerce [woo-vipps]

Researcher

More Details >

Payments for Hubtel <= 1.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96200
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Payments for Hubtel [payments-hubtel]

Researcher

More Details >

Payments for Hubtel <= 1.0.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96255
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Payments for Hubtel [payments-hubtel]

Researcher

More Details >

Payments for Hubtel <= 1.0.1 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96173
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Payments for Hubtel [payments-hubtel]

Researcher

More Details >

Paytm Payment Gateway <= 2.8.8 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81740
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

Paytm Payment Gateway [paytm-payments]

Researcher

More Details >

Photo Reviews for WooCommerce <= 1.2.30 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-100517
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Photo Reviews for WooCommerce [woo-photo-reviews]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.13 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103345
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Pie Register – User Registration, Profiles & Content Restriction [pie-register]

Researcher

More Details >

Pie Register <= 3.8.4.13 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96962
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Pie Register – User Registration, Profiles & Content Restriction [pie-register]

Researcher

More Details >

ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62061
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]

Researcher

More Details >

Razorpay for WooCommerce <= 4.8.7 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-104118
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Razorpay for WooCommerce [woo-razorpay]

Researcher

More Details >

Request a Quote <= 2.5.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90988
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

Request a Quote – Quote Forms for Any WordPress Site [request-a-quote]

Researcher

More Details >

REST API Log <= 1.7.2 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-100514
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

REST API Log [wp-rest-api-log]

Researcher

More Details >

SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO 3.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97280
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO [review-schema]

Researcher

More Details >

SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97282
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO [review-schema]

Researcher

More Details >

Sermon’e <= 1.0.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48199
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Sermon’e [sermone]

Researcher

More Details >

Site Reviews <= 8.3.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103340
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Site Reviews [site-reviews]

Researcher

More Details >

Slider Pro <= 1.0.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86786
Patch Status

Unpatched
Published
Oct 3, 2026

Affected Software

Slider Pro [slider-pro-wp]

Researcher

More Details >

Smart One Click Setup – Complete Demo Import & Export <= 1.4.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-32584
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

Smart One Click Setup – Complete Demo Import & Export [smart-one-click-setup]

Researcher

More Details >

Solace Extra <= 1.7.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-80333
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Solace Extra [solace-extra]

Researcher

More Details >

StifLi Backup Tools <= 2.2.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97240
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

StifLi Backup Tools [stifli-backup-tools]

Researcher

More Details >

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62073
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions [wp-full-stripe-free]

Researcher

More Details >

TillKit <= 1.0.4 – Unauthenticated Privileged POS Session Hijacking

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91078
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

TillKit [tillkit]

Researcher

More Details >

Timetics – Appointment Booking Calendar & Scheduling <= 1.0.63 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97304
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Timetics – Appointment Booking Calendar & Scheduling [timetics]

Researcher

1e008e2827556f92e4e1199ee59c1c4ddcs

More Details >

Ultimate CSV Importer <= 9.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-80518
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]

Researcher

More Details >

Ultimate Maps by Supsystic <= 1.5.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-102397
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]

Researcher

More Details >

Ultimate Review <= 2.4.3 – Unauthenticated Persistent Denial of Service

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-101160
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP Ultimate Review [wp-ultimate-review]

Researcher

More Details >

Ultimate Review <= 2.4.3 – Unauthenticated Persistent Page Denial of Service

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-101161
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP Ultimate Review [wp-ultimate-review]

Researcher

More Details >

Unlimited Elements for Elementor <= 2.0.20 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103341
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

UPI QR Code Payment Gateway <= 1.4.3 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84169
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

UPI QR Code Payment Gateway [upi-qr-code-payment-gateway]

Researcher

More Details >

User Frontend 2.5.8 – 4.3.11 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-75824
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

More Details >

User Private Files <= 2.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97332
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

User Private Files – Secure File Sharing and Client Portal Plugin [user-private-files]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96334
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WebToffee Gift Cards for WooCommerce <= 1.3.0 – Unauthenticated Arbitrary Gift Card Price Manipulation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91020
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

WebToffee Gift Cards for WooCommerce [wt-gift-cards-woocommerce]

Researcher

More Details >

WebToffee WP Backup and Migration <= 1.6.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97197
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

WebToffee WP Backup and Migration [wp-migration-duplicator]

Researcher

More Details >

WP Express Checkout (Fast Payments via PayPal & Stripe) <= 2.4.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96818
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

WP Express Checkout (Fast Payments via PayPal & Stripe) [wp-express-checkout]

Researcher

More Details >

WP Popular Posts <= 7.4.2 – Unauthenticated Information Disclosure in ‘post_type’ and ‘context’ Parameters

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92548
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

WP Popular Posts [wordpress-popular-posts]

Researcher

More Details >

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-103336
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]

Researcher

More Details >

WPCafe <= 3.0.19 – Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11601
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

More Details >

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97269
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

More Details >

WPMobile.App – Android and iOS App Builder <= 11.83 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96342
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

WPMobile.App – Android and iOS App Builder [wpappninja]

Researcher

More Details >

WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 – Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-100149
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons [social-icons-widget-by-wpzoom]

Researcher

More Details >

YayReviews 1.0.4 – 1.4.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94274
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

YayReviews – Advanced Customer Reviews for WooCommerce [yay-customer-reviews-woocommerce]

Researchers

More Details >

워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.5.17 – Missing Authorization to Unauthenticated Settings Update

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95597
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce]

Researcher

More Details >

Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.27 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-62097
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Business Directory Plugin – Easy Listing & Member Directories for WordPress [business-directory-plugin]

Researcher

More Details >

Captivate Sync <= 3.3.2 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-62060
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Captivate Sync [captivatesync-trade]

Researcher

More Details >

MPG <= 4.2.2 – Authenticated (Editor+) Arbitrary File Read

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-103293
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]

Researcher

More Details >

SEOPress <= 10.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘seopress_google_analytics_matomo_id’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-101357
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]

Researcher

More Details >

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-62059
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

WP Activity Log <= 5.6.6 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-62085
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

WP Activity Log [wp-security-audit-log]

Researcher

More Details >

WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 – Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field

4.9

CVSS Rating
4.9 (Medium)
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]

Researcher

More Details >

Calculated Fields Form <= 5.5.1.3 – Reflected DOM-Based Cross-Site Scripting via ‘x’ URL Query Parameter via Text Area Predefined Value

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-100184
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

EWWW Image Optimizer <= 8.7.0 – Authenticated (Administrator+) Cross-Site WebP File Deletion or Rename

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-91072
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

EWWW Image Optimizer [ewww-image-optimizer]

Researcher

More Details >

Giveaways and Contests by RafflePress <= 1.12.26 – Unauthenticated Open Redirect

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-97318
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers [rafflepress]

Researcher

More Details >

Mail Logging <= 1.16.0 – Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-1661
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

WP Mail Logging [wp-mail-logging]

Researcher

More Details >

MetForm <= 4.3.0 – Unauthenticated Arbitrary HTML Injection in Notification Emails

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-86833
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform]

Researcher

More Details >

Safe Redirect Manager <= 2.2.0 – Unauthenticated Open Redirect

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-88791
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Safe Redirect Manager [safe-redirect-manager]

Researcher

More Details >

If-So Dynamic Content 1.9.9 – 1.10.1 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-87973
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]

Researcher

More Details >

Prime Mover – Backup and Migration <= 2.2.0 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-101890
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Prime Mover – Backup and Migration [prime-mover]

Researcher

More Details >

Schema & Structured Data for WP & AMP <= 1.66 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-82127
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

Simple Shopping Cart <= 5.2.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-104119
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]

Researcher

More Details >

Tabs Responsive <= 2.5 – Authenticated (Shop Manager+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-13718
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]

Researcher

More Details >

Ultimate CSV Importer 7.17 – 9.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-80517
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]

Researcher

More Details >

2FA <= 4.0.0 – Unauthenticated Two-Factor Authentication Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103514
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

WP 2FA – Two-factor authentication for WordPress [wp-2fa]

Researcher

More Details >

Academy LMS <= 4.0.1 – Authenticated (Contributor+) Arbitrary HTML File Read via ‘id’ Parameter in /wp/v2/templates REST Route

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

More Details >

Advanced Ads – Ad Manager & AdSense <= 2.0.26 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94180
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

Advanced Ads – Ad Manager & AdSense [advanced-ads]

Researcher

More Details >

Advanced Partial Payment or Deposit for WooCommerce <= 4.0.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-95589
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Advanced Partial Payment or Deposit for WooCommerce [advanced-partial-payment-or-deposit-for-woocommerce]

Researcher

More Details >

Airano MCP Bridge <= 2.11.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-32585
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

Airano MCP Bridge [airano-mcp-bridge]

Researcher

More Details >

All in One Files Upload for WooCommerce <= 2.0.16 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85576
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

All in One Files Upload for WooCommerce [all-in-one-files-upload-for-woocommerce]

Researcher

More Details >

AllAble Connector <= 0.13.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97243
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

AllAble Connector [allable-connector]

Researcher

More Details >

Alt Text AI <= 1.10.41 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91108
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Alt Text AI – Automatically generate image alt text for SEO and accessibility [alttext-ai]

Researcher

More Details >

Aruba Migration Tool <= 1.0.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97258
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Aruba Migration Tool [aruba-wp-migration-tool]

Researcher

More Details >

Burst Statistics <= 3.7.1 – Improper Authentication to Account Persistence via Share-Link Authentication Bypass via ‘burst_share_token’

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97343
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) [burst-statistics]

Researcher

More Details >

ECPay Ecommerce for WooCommerce <= 1.1.2606090 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-32578
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

ECPay Ecommerce for WooCommerce [ecpay-ecommerce-for-woocommerce]

Researcher

More Details >

Faktur Pro for WooCommerce <= 3.2.2 – Authenticated (Customer+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-32576
Patch Status

Unpatched
Published
Oct 4, 2026

Affected Software

Faktur Pro for WooCommerce [woorechnung]

Researcher

More Details >

Featured Image from URL (FIFU) <= 6.0.7 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96671
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Featured Image from URL (FIFU) [featured-image-from-url]

Researcher

More Details >

File Media Renamer <= 1.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94278
Patch Status

Unpatched
Published
Oct 3, 2026

Affected Software

File Media Renamer [file-media-renamer]

Researcher

More Details >

Five Star Business Profile and Schema 2.3.20 – 2.3.21 – Authenticated (Author+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-86817
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Five Star Business Profile and Schema [business-profile]

Researcher

More Details >

Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce <= 1.14.11 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62081
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce [flexible-coupons]

Researcher

More Details >

FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.12.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94499
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More [formgent]

Researcher

More Details >

Fusion Lite <= 3.47.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-90972
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

WP Fusion Lite – Marketing Automation and CRM Integration for WordPress [wp-fusion-lite]

Researcher

More Details >

Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program <= 4.6.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97297
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program [gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce]

Researcher

More Details >

Helpdesk Support Ticket System for WooCommerce <= 2.1.6 – Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via ‘id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11399
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Helpdesk Support Ticket System for WooCommerce [support-ticket-system-for-woocommerce]

Researcher

More Details >

IATO MCP <= 1.12.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-32582
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

IATO MCP [iato-mcp]

Researcher

More Details >

Image Optimizer by Elementor <= 1.7.6 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-90953
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Image Optimizer [image-optimizer]

Researcher

More Details >

Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39444
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]

Researcher

1e008e2827556f92e4e1199ee59c1c4ddcs

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39717
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

Loco Translate <= 2.8.8 – Authenticated (Translator+) Limited File Read

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94238
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Loco Translate [loco-translate]

Researcher

More Details >

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-102382
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]

Researcher

More Details >

MakeCommerce for WooCommerce <= 4.1.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96817
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

MakeCommerce for WooCommerce [makecommerce]

Researcher

More Details >

MCP Content Manager Lite <= 1.1.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97239
Patch Status

Patched
Published
Sep 29, 2026

Affected Software

MCP Content Manager Lite [mcp-content-manager-lite]

Researcher

More Details >

Media Library Organizer 2.0.4 – 2.1.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94297
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Media Library Organizer – Folders, File Manager & Media Categories [media-library-organizer]

Researcher

More Details >

Memberful – Membership Plugin <= 1.81.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103067
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Memberful – Membership Plugin [memberful-wp]

Researcher

More Details >

Mindio Magic MCP <= 0.5.6 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-104402
Patch Status

Patched
Published
Oct 2, 2026

Affected Software

Mindio Magic MCP [mindio-magic-mcp]

Researcher

More Details >

Motors – Car Dealership & Classified Listings <= 1.4.123 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91023
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

MStore API 4.21.1 – 4.22.0 – Authenticated (Subscriber+) Payment Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97219
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

MStore API – Create Native Android & iOS Apps On The Cloud [mstore-api]

Researcher

More Details >

Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97074
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Newsletters, Email Marketing, SMS and Popups by Omnisend [omnisend]

Researcher

More Details >

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-102375
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

More Details >

Photo Gallery – Responsive Image Galleries by Supsystic <= 1.21.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-102399
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Photo Gallery – Responsive Image Galleries by Supsystic [gallery-by-supsystic]

Researcher

More Details >

Popup Maker WP <= 1.4.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85004
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More [popup-maker-wp]

Researcher

More Details >

Popup Maker WP 1.2.2.1 – 1.4.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85005
Patch Status

Unpatched
Published
Sep 29, 2026

Affected Software

Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More [popup-maker-wp]

Researcher

More Details >

Prevent Files / Folders Access <= 2.6.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97267
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Prevent Files / Folders Access [prevent-file-access]

Researcher

More Details >

Progress Planner <= 1.10.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62072
Patch Status

Patched
Published
Oct 4, 2026

Affected Software

Progress Planner [progress-planner]

Researcher

More Details >

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97281
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]

Researcher

More Details >

Razorpay Payment Links for WooCommerce <= 2.1.5 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97299
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Razorpay Payment Links for WooCommerce [rzp-woocommerce]

Researcher

More Details >

Redux Framework <= 4.5.14 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via ‘attachment_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88999
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

More Details >

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1226 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97309
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]

Researcher

More Details >

Robin Image Optimizer <= 2.0.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89190
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF [robin-image-optimizer]

Researcher

More Details >

Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more <= 3.0.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97303
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more [scratch-win-giveaways-for-website-facebook]

Researcher

More Details >

SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more <= 1.23.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103337
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more [wc-ukr-shipping]

Researcher

More Details >

Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more <= 3.6.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97277
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more [social-boost]

Researcher

More Details >

The Events Calendar <= 6.17.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97285
Patch Status

Patched
Published
Sep 30, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researcher

More Details >

Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62063
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Travelly – Tour & Travel Booking Manager for WooCommerce [tour-booking-manager]

Researcher

More Details >

User Frontend <= 4.3.11 – Authenticated (Subscriber+) Subscription-Gated Post Creation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-79618
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

More Details >

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-103086
Patch Status

Patched
Published
Oct 3, 2026

Affected Software

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp]

Researcher

More Details >

Vayu X <= 1.0.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88797
Patch Status

Patched
Published
Sep 28, 2026

Affected Software

Vayu X [vayu-x]

Researcher

More Details >

Wallstreet <= 2.8.6 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39718
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

Wallstreet [wallstreet]

Researcher

More Details >

WDS MCP Content Manager <= 3.10.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39599
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

WDS MCP Content Manager [wds-mcp-content-manager]

Researcher

More Details >

WebSamurai <= 1.0.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39439
Patch Status

Unpatched
Published
Oct 2, 2026

Affected Software

WebSamurai [websamurai]

Researcher

More Details >

Otter Blocks <= 3.2.6 – Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget

3.1

CVSS Rating
3.1 (Low)
CVE-ID

CVE-2026-102002
Patch Status

Patched
Published
Oct 1, 2026

Affected Software

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026) appeared first on Wordfence.

]]> Cybersecurity Imperatives Will Demand AI Math https://swiftupdates.ca/cybersecurity-imperatives-will-demand-ai-math/ Thu, 08 Oct 2026 21:47:38 +0000 https://swiftupdates.ca/cybersecurity-imperatives-will-demand-ai-math/ “I think we might lose public key cryptography.” ~Matthew Green

The above is from Matthew Green, yesterday, who is a cryptographer at Johns Hopkins. OpenAI released over 700 mathematical proofs as a github repository yesterday. They’ve since withdrawn 3 of them.

The reaction from mathematicians has been frustration and some anger and sadness, and there’s much debate about the role of AI in math. I’d encourage you to read the first few messages on this Hacker News thread for context.

You can’t argue with outcomes, and the repository they released includes LEAN proofs that provide a very high degree of confidence in the logical validity of each proof. Some mathematicians are calling this “the most significant moment in mathematical history”.

Meanwhile we continue to work with Mythos and cyber capable OpenAI and Anthropic models at Wordfence, and this is giving us a first hand look at how models compare to our human capabilities. Wordfence Argus continues to find extremely severe vulnerabilities, many of which are making their way through the confidential disclosure process. And Wordfence PRISM continues to give us broad coverage across the plugin and theme ecosystem.

The Web is built on the assumption that some math problems are too hard to solve within a reasonable amount of time. Specifically, we have a system called public key cryptography that lets two strangers establish a secure channel of communication that someone else can’t listen in on, and the security of that channel relies on the assumption that the stranger can’t solve a hard math problem in less than several thousand years, given our current state of computational resources, and our current knowledge of math.

It’s that last bit that’s concerning. The current state of math just jumped forward by around 700 proofs in a day. A former OpenAI employee commented on X that 81% of all math discoveries in the past 3 years were released yesterday.

We’re entering a new uncertain era where the pace of innovation continues to accelerate to something our species has never seen before. The math solutions we’ve implemented have thus far been reliant on breakthroughs happening slower. For example, we’ve been working on quantum computing for some time and have expected it to make certain kinds of encryption vulnerable. And so we came up with a post-quantum algorithm called ML-KEM which is more resistant to quantum attacks. And we had time to do this.

With the pace of math innovation accelerating to unexpected levels, we may find ourselves in a situation where overnight the current cryptographic algorithms we use are vulnerable to attack and need to be replaced or upgraded. In the face of opposition from some mathematicians, if OpenAI doesn’t make math breakthroughs, Anthropic will, and if they don’t DeepSeek, Z.ai and other companies will. And the reality is that they are all working on math, and other hard problems, as a demonstration of capability to help sell their models.

Cybersecurity is built on math, and if public key encryption falls and we don’t have a replacement ready, the Web grinds to a halt. Your WooCommerce or Shopify store can’t do business because your customers can’t securely transact. Your business goes away, overnight, because credit card numbers and other payment tokens can no longer securely cross the network.

If AI can break cryptographic algorithms, then AI can develop new algorithms, just like humans did, that are more resistant to attack. We may also need to upgrade the rapidity with which we can patch which algorithms are used in applications, so that we’re able to rapidly deploy new validated cryptographic algorithms as they emerge. In other words, we need to adapt our infrastructure to accommodate the new much faster, and accelerating pace of innovation in math and computer science.

If you’re not a mathematician or AI engineer and are running a business on the Web, my suggestion would be to maintain situational awareness on developments in cybersecurity and how AI is impacting it, and get into a healthy daily routine of updating your software and systems as needed. As these problems are solved, it may simply be a case of updating. If a new way of doing things emerges, it may take a bit more effort.

The good news is that we’re all in this together. We run an ecommerce site here too, which relies on public key encryption, just like yours. If public key encryption falls overnight, the amount of energy, motivation, coordination and available resources to fix it is massive. At Wordfence we’ll certainly keep our customers apprised in real-time of developments and changes they need to make.

ADDENDUM:

“Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I’ve witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case.”

Justin Drake (a bitcoin security researcher) on X suggesting that strong cryptographic algorithms may already have been broken or weakened, and we’re not hearing about it due to government censorship which has some precedent.

The post Cybersecurity Imperatives Will Demand AI Math appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-21-2026-to-september-27-2026/ Thu, 01 Oct 2026 18:38:34 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-21-2026-to-september-27-2026/ Last week, there were 319 vulnerabilities disclosed in 222 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 156 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 305
Unpatched 14

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 226
High Severity 79
Critical Severity 14

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 96
Missing Authorization 59
Authorization Bypass Through User-Controlled Key 26
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 24
Exposure of Sensitive Information to an Unauthorized Actor 22
Improper Privilege Management 14
Deserialization of Untrusted Data 11
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 11
Improper Control of Generation of Code (‘Code Injection’) 8
Client-Side Enforcement of Server-Side Security 7
Server-Side Request Forgery (SSRF) 7
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 5
Incorrect Authorization 5
Cross-Site Request Forgery (CSRF) 4
Improper Authentication 4
Improper Authorization 3
Protection Mechanism Failure 3
Uncontrolled Resource Consumption 3
Guessable CAPTCHA 2
Unrestricted Upload of File with Dangerous Type 2
Improper Input Validation 1
Incorrect Privilege Assignment 1
Origin Validation Error 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

34

11

11

8

8

8

8

8

7

6

6

6

5

5

5

4

4

4

4

4

4

3

3

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1
5a50351dc3a5975487697a55ad3936d5
UKO

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
140bd95361e8450fe8b798cc5ba97c8a
Bee

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
1e008e2827556f92e4e1199ee59c1c4d
dcs

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
10Web Booster – Website speed optimization, Cache & Page Speed optimizer tenweb-speed-optimizer
Ad Inserter – Ad Manager & AdSense Ads ad-inserter
Admin Notices Manager admin-notices-manager
Advanced Contact form 7 DB advanced-cf7-db
AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine
All-In-One Security (AIOS) – Security and Firewall all-in-one-wp-security-and-firewall
AMP for WP – Accelerated Mobile Pages accelerated-mobile-pages
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) appmysite
Appointment Booking Plugin & Scheduling System – Webba Booking Calendar webba-booking-lite
Asset CleanUp: Page Speed Booster wp-asset-clean-up
Automatic.css automatic-css
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code automation-web-platform
BA Book Everything ba-book-everything
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots bp-better-messages
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification wc-blacklist-manager
Blocksy Companion blocksy-companion
Blog2Social: Social Media Auto Post & Scheduler blog2social
Bluff Post bluff-post
BM Content Builder bm-builder
Booking Calendar booking
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar booking-manager
Business Directory Plugin – Easy Listing & Member Directories for WordPress business-directory-plugin
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More calculated-fields-form
Captcha Code captcha-code-authentication
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce cartflows
CMB2 cmb2
CMP – Coming Soon & Maintenance Plugin by NiteoThemes cmp-coming-soon-maintenance
Conekta Payment Gateway conekta-payment-gateway
Contextual Related Posts contextual-related-posts
Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster
CSS & JavaScript Toolbox css-javascript-toolbox
Custom Field Template custom-field-template
Custom Thank You Page for WooCommerce custom-thank-you-page
Customer Reviews for WooCommerce customer-reviews-woocommerce
Directorist: AI-Powered Business Directory, Listings & Classified Ads directorist
Ditty – Responsive News Tickers, Sliders, and Lists ditty-news-ticker
Divi Dash divi-dash
Download Manager downloadmanager
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy easy-digital-downloads
Easy Hide Login easy-hide-login
eesy_ID2WP – Publish InDesign HTML5 eesy-id2wp-publish-indesign-html5
Elementor Website Builder – more than just a page builder elementor
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor elementskit-lite
Email Log email-log
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress email-subscribers
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents embedpress
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce erp
Estatik Real Estate Plugin estatik
EthPress – Web3 Login ethpress
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar mage-eventpress
Event Tickets and Registration event-tickets
Events Manager – Calendar, Bookings, Tickets, Appointments and more! events-manager
Fancy Product Designer fancy-product-designer
File Manager wp-file-manager
File Manager Pro – Filester filester
FileOrganizer – WordPress File Manager fileorganizer
Fluent Support – Helpdesk & Customer Support Ticket System fluent-support
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration fluent-boards
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI gamipress
GEO Plugin by Squirrly SEO squirrly-seo
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
Give Tributes give-tributes
GiveWP – Donation Plugin and Fundraising Platform give
Go Live Update Urls go-live-update-urls
Groups – Memberships and Access Control groups
Gutenverse – WordPress Blocks, Page Builder & Site Editor gutenverse
Handily handily
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates happy-elementor-addons
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms happyforms
HashBar – Announcement, Notification Bar & Popup Campaign hashbar-wp-notification-bar
Hostel hostel
HT Contact Form – Drag & Drop Form Builder for WordPress ht-contactform
HUSKY – Products Filter for WooCommerce Professional woocommerce-products-filter
Image Buzz image-buzz
Import and export users and customers import-users-from-csv-with-meta
JetEngine jet-engine
JetFormBuilder Stripe Gateway jet-form-builder-stripe-gateway
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
JetTricks jet-tricks
JSM Show Post Metadata jsm-show-post-meta
Kadence WooCommerce Email Designer kadence-woocommerce-email-designer
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder king-addons
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more knit-pay
LayerSlider LayerSlider
Link Library link-library
Live Composer – Free WordPress Website Builder live-composer-page-builder
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator live-copy-paste
Mailchimp for WooCommerce mailchimp-for-woocommerce
MailerLite – Signup forms (official) official-mailerlite-sign-up-forms
Malcure Malware Shield — Removal, Repair, Monitor wp-malware-removal
Mang Board mangboard
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution marketking-multivendor-marketplace-for-woocommerce
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP ai-workflow-automation-ai-agent-hub
Meta Box AIO meta-box-aio
Meta Box Frontend Submission mb-frontend-submission
Meta Box User Profile mb-user-profile
miniOrange OTP Login, Verification and SMS Notifications miniorange-otp-verification
Modula Image Gallery – Photo Grid & Video Gallery modula-best-grid-gallery
Mollie Forms mollie-forms
Netgsm netgsm
Newsletters newsletters-lite
NextScripts: Social Networks Auto-Poster social-networks-auto-poster-facebook-twitter-g
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder ninja-forms
Ninja Tables – Easy Data Table Builder ninja-tables
NP Quote Request for WooCommerce woo-rfq-for-woocommerce
Ocean Extra ocean-extra
Online Booking & Scheduling Calendar by vcita meeting-scheduler-by-vcita
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin desktop-mode
Optima Express IDX optima-express
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management wp-payment-form
Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce
Paymob for WooCommerce paymob-for-woocommerce
PayPlus Payment Gateway payplus-payment-gateway
Paytium: Mollie payment forms & donations paytium
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing woocommerce-google-adwords-conversion-tracking-tag
PixelPlay pixelplay
PixelYourSite – Your smart PIXEL (TAG) & API Manager pixelyoursite
Podcast Importer SecondLine podcast-importer-secondline
Points and Rewards for WooCommerce points-and-rewards-for-woocommerce
Post Grid Gutenberg Blocks – PostX ultimate-post
Post Voting System post-voting-system
PowerPress Podcasting plugin by Blubrry powerpress
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates premium-addons-for-elementor
Premium Blocks – Gutenberg Blocks, Patterns & Templates premium-blocks-for-gutenberg
Premium Packages – Sell Digital Products Securely wpdm-premium-packages
Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster easy-sale-badges-for-woocommerce
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels webappick-product-feed-for-woocommerce
Product Filter for WooCommerce by WBW woo-product-filter
Product Table & List Builder for WooCommerce wc-product-table-lite
PublishPress Capabilities: User Role Access Control, Admin Area Permissions capability-manager-enhanced
Razorpay Payment Button Plugin razorpay-payment-button
Real3D Flipbook real3d-flipbook
Rename wp-login.php to anything you want rename-wp-loginphp-to-anything-you-want
Repeater Fields for Elementor Forms repeater-for-elementor
Request a Quote for WooCommerce woocommerce-request-a-quote
Restaurant Menu and Food Ordering mp-restaurant-menu
Reycob Product Import Export reycob-product-import-export
RW Elephant Rental Inventory rw-elephant-rental-inventory
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions s2member
Safe SVG safe-svg
Shopping Cart & eCommerce Store wp-easycart
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel-image-optimiser
Simple Discount Rules for Woocommerce woo-product-category-discount
Simply Schedule Appointments simply-schedule-appointments
Site Reviews site-reviews
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP siteskite
Spectra Legacy – Gutenberg Blocks ultimate-addons-for-gutenberg
Sprout Invoices – Client Invoicing & Estimates sprout-invoices
SPS-Suite sps-suite-121
SSL Zen — SSL Certificate Installer & HTTPS Redirects ssl-zen
Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form wp-subscribe-form
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments surecart
Tainacan tainacan
Tangible: Loops & Logic tangible-loops-and-logic
Team Members tc-team-members
Team – Team Members Showcase Plugin tlp-team
Template Kit – Import template-kit-import
Testimonials Widget testimonials-widget
Text Styler text-styler
The Events Calendar the-events-calendar
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates the-plus-addons-for-elementor-page-builder
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid the-post-grid
ThemeREX Addons trx_addons
Themify Builder themify-builder
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More image-sizes
Translate WordPress with GTranslate gtranslate
TranslatePress – Translate Multilingual sites with AI Translation translatepress-multilingual
TrustedLogin Connector trustedlogin-connector
Tutor LMS – eLearning and online course solution tutor
Ultimate FAQ Accordion Plugin ultimate-faqs
Ultimeter – the Ultimate Progress and Goals Meter ultimeter
Ultra Addons for Contact Form 7 ultimate-addons-for-contact-form-7
UpdraftPlus: WP Backup & Migration Plugin updraftplus
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission wp-user-frontend
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor profile-builder
Verge3D Publishing and E-Commerce verge3d
Visual Composer Website Builder visualcomposer
W4 Post List w4-post-list
WC Fields Factory wc-fields-factory
WebFacing™ – Email Accounts management for cPanel® wf-cpanel-email-accounts
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards wp-data-access
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) delicious-recipes
WP Directory Kit wpdirectorykit
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings wp-google-map-plugin
WP Multilang – Translation and Multilingual Plugin wp-multilang
WP OAuth Server ( Login with WordPress ) miniorange-oauth-20-server
WP Photo Album Plus wp-photo-album-plus
WP Recipe Maker wp-recipe-maker
WP Review Slider Pro wp-review-slider-pro
WP Statistics – Simple, privacy-friendly Google Analytics alternative wp-statistics
WP Store Locator wp-store-locator
WP Table Builder – Drag & Drop Table Builder wp-table-builder
WP Travel Engine – Tour Booking Plugin – Tour Operator Software wp-travel-engine
WP Ultimate Review wp-ultimate-review
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory wp-user-manager
WP Verify API wp-verify-api
WP Yelp Review Slider wp-yelp-review-slider
WP YouTube Lyte wp-youtube-lyte
WP-CRM System – Manage Clients and Projects wp-crm-system
WPC Product Bundles for WooCommerce woo-product-bundle
WPC Smart Compare for WooCommerce woo-smart-compare
WPeMatico RSS Feed Fetcher wpematico
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More wpforms-lite
wpForo Forum wpforo
WPS Limit Login wps-limit-login
WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent wsp-mcp-ai-agents-connector
YAHMAN Add-ons yahman-add-ons
YITH Request a Quote for WooCommerce yith-woocommerce-request-a-quote
YITH WooCommerce Ajax Search yith-woocommerce-ajax-search
YOP Poll yop-poll
Zero Spam for WordPress zero-spam
Zportals zportals
پارسی دیت – Parsi Date wp-parsidate

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Automation Web Platform <= 4.8.6 – Unauthenticated Privilege Escalation via ‘wawp_custom_fields’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14281
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code [automation-web-platform]

Researcher

More Details >

Give Tributes <= 2.3.1 – Unauthenticated PHP Object Injection via ‘give_tributes_ecard_notify[recipient][personalized][]’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-19658
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Give Tributes [give-tributes]

Researcher

More Details >

Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions – Unauthenticated Privilege Escalation to Administrator to ‘rwmb_frontend_field_object_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-13355
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Meta Box User Profile [mb-user-profile]

Researcher

More Details >

Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions – Unauthenticated Privilege Escalation to Administrator to ‘rwmb_frontend_field_object_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-13355
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Meta Box AIO [meta-box-aio]

Researcher

More Details >

Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions – Unauthenticated Privilege Escalation to Administrator to ‘rwmb_frontend_field_object_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-13355
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Meta Box Frontend Submission [mb-frontend-submission]

Researcher

More Details >

Meta Box AIO <= 3.7.2 And Standalone Plugin Extensions – Unauthenticated Privilege Escalation to Administrator to ‘rwmb_frontend_field_object_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-13355
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Meta Box AIO [meta-box-aio]
Meta Box Frontend Submission [mb-frontend-submission]
Meta Box User Profile [mb-user-profile]

Researcher

More Details >

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 – Unauthenticated Authentication Bypass via ‘mo_wp_login_intent’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-85984
Patch Status

Patched
Published
Sep 26, 2026

Affected Software

miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]

Researcher

More Details >

Paytium: Mollie payment forms & donations <= 5.0.3 – Unauthenticated Privilege Escalation via ‘pt_form_field[pt-user-role]’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-18467
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Paytium: Mollie payment forms & donations [paytium]

Researcher

More Details >

Request a Quote for WooCommerce <= 2.9.2 – Unauthenticated Arbitrary File Upload via AJAX Popup Handler

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-18143
Patch Status

Unpatched
Published
Sep 25, 2026

Affected Software

Request a Quote for WooCommerce [woocommerce-request-a-quote]

Researcher

More Details >

Ultra Addons for Contact Form 7 <= 3.5.50 – Unauthenticated Arbitrary File Upload via Signature Form Field

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-82901
Patch Status

Patched
Published
Sep 26, 2026

Affected Software

Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]

Researcher

More Details >

Visual Composer Website Builder <= 45.16.0 – Unauthenticated Local File Inclusion via ‘vcv-template’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12227
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Visual Composer Website Builder [visualcomposer]

Researchers

More Details >

YAHMAN Add-ons <= 0.9.30 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-75799
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

YAHMAN Add-ons [yahman-add-ons]

Researcher

More Details >

Customer Reviews for WooCommerce <= 5.120.0 – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via ‘items[][media]’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-89055
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Customer Reviews for WooCommerce [customer-reviews-woocommerce]

Researcher

More Details >

Online Scheduling and Appointment Booking System <= 28.2 – Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via ‘order_id’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-93399
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

BM Content Builder < 3.17.1 – Authenticated (Subscriber+) Arbitrary File Deletion

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2025-1281
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

BM Content Builder [bm-builder]

Researcher

More Details >

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.2.0 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-96837
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce [cartflows]

Researcher

More Details >

Elementor Website Builder 4.3.0 – 4.3.1 – Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-62062
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Elementor Website Builder – more than just a page builder [elementor]

Researchers

More Details >

Groups <= 4.6.0 – Authenticated (Subscriber+) Privilege Escalation via ‘groups_join’ Shortcode

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-77203
Patch Status

Patched
Published
Sep 26, 2026

Affected Software

Groups – Memberships and Access Control [groups]

Researcher

More Details >

Import and export users and customers <= 2.4.17 – Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-86583
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

Knit Pay <= 9.6.1.0 – Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-89426
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more [knit-pay]

Researcher

More Details >

OAuth Server <= 6.3.0 – Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-82843
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP OAuth Server ( Login with WordPress ) [miniorange-oauth-20-server]

Researcher

More Details >

s2Member <= 260814 – Unauthenticated Remote Code Execution via ‘first_name’ Parameter in PayPal Proxy Return

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-19804
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions [s2member]

Researcher

More Details >

YOP Poll <= 7.0.10 – Unauthenticated Origin Validation Error to Administrator Account Takeover via ‘/auth/wp-login-redirect’ REST Route

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-85682
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

YOP Poll [yop-poll]

Researcher

More Details >

EthPress <= 2.3.5 – Unauthenticated Authentication Bypass

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-19125
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

EthPress – Web3 Login [ethpress]

Researcher

More Details >

HUSKY <= 1.4.4 – Unauthenticated Local File Inclusion via ‘custom_tpl’ Shortcode Attribute via ‘woof_draw_products’ AJAX

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-92969
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

HUSKY – Products Filter for WooCommerce Professional [woocommerce-products-filter]

Researcher

More Details >

Modula Image Gallery <= 3.0.2 – Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via ‘file’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-92713
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]

Researcher

More Details >

Ninja Forms <= 3.15.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-91827
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]

Researcher

More Details >

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-95525
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

More Details >

WebFacing Email Accounts for cPanel 5.3 – 5.3.6 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-84069
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WebFacing™ – Email Accounts management for cPanel® [wf-cpanel-email-accounts]

Researcher

More Details >

WordPress Core <= 7.1.1 – Unauthenticated Local File Inclusion via locate_template() Path Traversal

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-87902
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP Ultimate Review <= 2.4.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘xs_submit_review_data[xs_reviw_summery]’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-92235
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP Ultimate Review [wp-ultimate-review]

Researcher

More Details >

10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94121
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]

Researcher

More Details >

Bluff Post <= 1.1.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89237
Patch Status

Unpatched
Published
Sep 23, 2026

Affected Software

Bluff Post [bluff-post]

Researcher

More Details >

Bookly 23.2 – 28.2 – Authenticated (Bookly Administrator+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-86841
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 – Unauthenticated Path Traversal to Arbitrary File Read via ‘id2wp_path’ Query Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-77193
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

eesy_ID2WP – Publish InDesign HTML5 [eesy-id2wp-publish-indesign-html5]

Researcher

More Details >

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94177
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]

Researcher

More Details >

GEO Plugin by Squirrly SEO <= 14.2.5 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94076
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

GEO Plugin by Squirrly SEO [squirrly-seo]

Researcher

More Details >

Go Live Update Urls <= 7.0.8 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94678
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Go Live Update Urls [go-live-update-urls]

Researcher

More Details >

JetFormBuilder Stripe Gateway <= 1.0.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2022-4997
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

JetFormBuilder Stripe Gateway [jet-form-builder-stripe-gateway]

Researcher

More Details >

MasterStudy LMS 3.5.29 – 3.7.49 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-88843
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

Modula Image Gallery <= 3.0.1 – Missing Authorization to Unauthenticated Private Gallery Image Disclosure via ‘modula_gallery_id’ and ‘modula_image_id’ Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89406
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]

Researcher

More Details >

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 – Unauthenticated Arbitrary File Read

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94123
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

Product Filter for WooCommerce by WBW <= 3.1.7 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-95601
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Product Filter for WooCommerce by WBW [woo-product-filter]

Researcher

More Details >

Rename wp-login.php to anything you want <= 2.0.1 – Unauthenticated SQL Injection via ‘log’ (Username) Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93368
Patch Status

Unpatched
Published
Sep 22, 2026

Affected Software

Rename wp-login.php to anything you want [rename-wp-loginphp-to-anything-you-want]

Researcher

More Details >

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.5 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-97246
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]

Researcher

More Details >

SPS-Suite <= 1.4.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93000
Patch Status

Unpatched
Published
Sep 25, 2026

Affected Software

SPS-Suite [sps-suite-121]

Researchers

More Details >

WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.84 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-93621
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards [wp-data-access]

Researcher

More Details >

WP Maps <= 4.9.8 – Authenticated (Subscriber+) Local File Inclusion via ‘page’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-13456
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin]

Researcher

More Details >

WP Store Locator < 3.0.0 – Unauthenticated Denial of Service

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-94681
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Store Locator [wp-store-locator]

Researcher

More Details >

WP Travel Engine <= 6.8.0 – Authenticated (Contributor+) Local File Inclusion via ‘template’ Shortcode Attribute

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9231
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]

Researcher

More Details >

wpForo Forum <= 3.1.5 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-80513
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

Optima Express IDX <= 8.7.5 – Unauthenticated Privilege Escalation to ‘ihf_clear_cache’ AJAX Action to Author Role Assignment

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-93901
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Optima Express IDX [optima-express]

Researcher

More Details >

Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97077
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

AMP for WP <= 1.1.16 – Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-83591
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages]

Researcher

More Details >

BA Book Everything <= 1.8.27 – Unauthenticated Stored Cross-Site Scripting via first_name Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96039
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

BA Book Everything [ba-book-everything]

Researcher

More Details >

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More <= 5.5.1.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95529
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]

Researcher

More Details >

CMP <= 4.1.17 – Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-12470
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]

Researcher

More Details >

Core Web Vitals & PageSpeed Booster <= 1.0.31 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95528
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Core Web Vitals & PageSpeed Booster [core-web-vitals-pagespeed-booster]

Researcher

More Details >

Download Manager Pro <= 7.5.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-86609
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Download Manager [downloadmanager]

Researcher

More Details >

Event Tickets and Registration <= 5.29.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93526
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Fancy Product Designer <= 6.5.2 – Unauthenticated Stored Cross-Site Scripting via ‘output_format’ Parameter via Pro Export Print Job

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84279
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Fancy Product Designer [fancy-product-designer]

Researcher

More Details >

Fancy Product Designer <= 6.5.2 – Unauthenticated Stored Cross-Site Scripting via ‘productTitle’ in ‘_fpd_data’ Order Item Meta

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84281
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Fancy Product Designer [fancy-product-designer]

Researcher

More Details >

Fancy Product Designer <= 6.5.2 – Unauthenticated Stored Cross-Site Scripting via Shortcode Order ‘elements[].title’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84280
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Fancy Product Designer [fancy-product-designer]

Researcher

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96830
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.15 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97065
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms [happyforms]

Researcher

More Details >

HT Contact Form <= 2.10.1 – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘form_data’ Rich Text Field via Draft Save/Resume

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93303
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

HT Contact Form – Drag & Drop Form Builder for WordPress [ht-contactform]

Researcher

More Details >

JetEngine <= 3.8.14.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97237
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

LayerSlider <= 8.4.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97253
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

LayerSlider [LayerSlider]

Researcher

More Details >

Link Library <= 7.9.5 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-78397
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Link Library [link-library]

Researcher

More Details >

Mang Board <= 2.4.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94176
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Mang Board [mangboard]

Researcher

1e008e2827556f92e4e1199ee59c1c4ddcs

More Details >

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95515
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]

Researcher

More Details >

Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94504
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]

Researcher

More Details >

Ninja Forms <= 3.15.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92438
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]

Researcher

More Details >

Premium Packages <= 7.2.1 – Unauthenticated Stored Cross-Site Scripting via ‘cart_items[][product_name]’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93654
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

More Details >

Product Table & List Builder for WooCommerce <= 5.6.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96814
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Product Table & List Builder for WooCommerce [wc-product-table-lite]

Researcher

More Details >

Razorpay Payment Button Plugin <= 2.4.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94179
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Razorpay Payment Button Plugin [razorpay-payment-button]

Researcher

More Details >

Repeater Fields for Elementor Forms <= 2.2.7 – Unauthenticated Stored Cross-Site Scripting via Repeater Field Value

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94573
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Repeater Fields for Elementor Forms [repeater-for-elementor]

Researcher

More Details >

Restaurant Menu and Food Ordering <= 2.4.14 – Unauthenticated Stored Cross-Site Scripting via ‘phone_number’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96568
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Restaurant Menu and Food Ordering [mp-restaurant-menu]

Researcher

More Details >

Site Reviews <= 8.3.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-94078
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Site Reviews [site-reviews]

Researcher

More Details >

Testimonials Widget <= 4.0.4 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96533
Patch Status

Unpatched
Published
Sep 24, 2026

Affected Software

Testimonials Widget [testimonials-widget]

Researcher

More Details >

ThemeREX Addons < 2.45.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-97235
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

ThemeREX Addons [trx_addons]

Researcher

More Details >

Themify Builder <= 7.8.1 – Unauthenticated Stored Cross-Site Scripting via ‘css[fonts]’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95864
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Themify Builder [themify-builder]

Researcher

More Details >

TranslatePress <= 3.3.5 – Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-89412
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]

Researcher

More Details >

User Profile Builder <= 4.0.2 – Unauthenticated Stored Cross-Site Scripting via Avatar Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-95866
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

More Details >

WP Photo Album Plus <= 9.3.02.002 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93774
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93770
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics]

Researcher

More Details >

WP Yelp Review Slider <= 9.2 – Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93778
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP Yelp Review Slider [wp-yelp-review-slider]

Researcher

More Details >

WPC Product Bundles for WooCommerce <= 8.6.6 – Unauthenticated Stored Cross-Site Scripting via ‘qty’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93836
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WPC Product Bundles for WooCommerce [woo-product-bundle]

Researcher

More Details >

WPS Limit Login <= 1.5.9.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93622
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

WPS Limit Login [wps-limit-login]

Researcher

More Details >

YITH WooCommerce Ajax Search <= 2.28.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96352
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

YITH WooCommerce Ajax Search [yith-woocommerce-ajax-search]

Researcher

More Details >

Zero Spam for WordPress <= 5.7.10 – Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96752
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Zero Spam for WordPress [zero-spam]

Researcher

More Details >

پارسی دیت – Parsi Date <= 6.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-96836
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

پارسی دیت – Parsi Date [wp-parsidate]

Researcher

More Details >

WP Table Builder 2.1.1 – 2.1.13 – Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via ‘ids’ Parameter

7.1

CVSS Rating
7.1 (High)
CVE-ID

CVE-2026-6922
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP Table Builder – Drag & Drop Table Builder [wp-table-builder]

Researcher

More Details >

Kadence WooCommerce Email Designer <= 1.5.19.1 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-94677
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Kadence WooCommerce Email Designer [kadence-woocommerce-email-designer]

Researcher

More Details >

Reycob Product Import Export <= 2.3.0 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-95603
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Reycob Product Import Export [reycob-product-import-export]

Researcher

More Details >

Ultra Addons for Contact Form 7 <= 3.5.51 – Authenticated (Editor+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-96833
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]

Researcher

More Details >

Advanced Contact form 7 DB <= 2.1.1 – Missing Authorization to Authenticated (Contributor+) Information Disclosure via ‘acf7db’ Shortcode

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-6831
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

Advanced Contact form 7 DB [advanced-cf7-db]

Researcher

More Details >

Better Messages <= 3.0.4 – Authenticated (Subscriber+) SQL Injection via ‘group_id’ Message Meta Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-93899
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

BM Content Builder < 3.17.1 – Authenticated (Subscriber+) Arbitrary File Read

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2025-1280
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

BM Content Builder [bm-builder]

Researcher

More Details >

Booking Manager <= 2.1.20 – Authenticated (Author+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-91024
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar [booking-manager]

Researcher

More Details >

Custom Thank You Page for WooCommerce <= 1.1.2 – Missing Authorization to Unauthenticated Settings Export and Settings Reset

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-4806
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Custom Thank You Page for WooCommerce [custom-thank-you-page]

Researcher

More Details >

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 – Authenticated (Author+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-96346
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]

Researcher

More Details >

GTranslate <= 5.0.0 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-86604
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Translate WordPress with GTranslate [gtranslate]

Researcher

More Details >

Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator <= 1.5.10 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-93527
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste]

Researcher

More Details >

Malcure Malware Shield <= 19.9.6 – Missing Authorization

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-96896
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Malcure Malware Shield — Removal, Repair, Monitor [wp-malware-removal]

Researcher

More Details >

Mollie Forms <= 2.11.0 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-93773
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Mollie Forms [mollie-forms]

Researcher

More Details >

Ninja Tables <= 5.2.16 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-86612
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Ninja Tables – Easy Data Table Builder [ninja-tables]

Researcher

More Details >

Post Voting System <= 1.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-89303
Patch Status

Unpatched
Published
Sep 25, 2026

Affected Software

Post Voting System [post-voting-system]

Researcher

More Details >

Recipe Maker <= 10.8.1 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-86601
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

Review Slider Pro <= 12.7.11 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-84097
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

Shopping Cart & eCommerce Store <= 5.9.4 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-94124
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Shopping Cart & eCommerce Store [wp-easycart]

Researcher

More Details >

Tainacan <= 1.2.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-95590
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Tainacan [tainacan]

Researcher

More Details >

Template Kit – Import <= 1.0.16 – Authenticated (Editor+) Arbitrary File Deletion

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-96824
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Template Kit – Import [template-kit-import]

Researcher

More Details >

WPForms Lite 1.5.0.1 – 2.0.2 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-84744
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]

Researcher

More Details >

Ad Inserter 2.8.12 – 2.8.18 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-81655
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

Automatic.css 4.0.0 – Unauthenticated Stored Cross-Site Scripting via REQUEST_URI

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15273
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Automatic.css [automatic-css]

Researcher

More Details >

Better Messages <= 3.0.4 – Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94376
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

Contextual Related Posts <= 4.4.1 – Authenticated (Author+) Stored Cross-Site Scripting via ‘other_attributes’ Block Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85653
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Contextual Related Posts [contextual-related-posts]

Researchers

More Details >

CSS & JavaScript Toolbox <= 12.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-14814
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

CSS & JavaScript Toolbox [css-javascript-toolbox]

Researcher

More Details >

Delicious <= 1.10.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-92411
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) [delicious-recipes]

Researcher

More Details >

Directorist <= 8.9.4 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84046
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]

Researcher

More Details >

Directory Kit <= 1.5.7 – Authenticated (Listing Admin+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-16591
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

More Details >

Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.69 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-93339
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]

Researcher

More Details >

Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.69 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94461
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]

Researcher

More Details >

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94500
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite]

Researcher

More Details >

EmbedPress <= 4.6.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85002
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress]

Researcher

More Details >

GeoDirectory <= 2.8.181 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., ‘phone’)

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-93897
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

More Details >

GeoDirectory <= 2.8.183 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘business_hours’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96766
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

More Details >

Gutenverse <= 4.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block ‘suffixMain’ Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-92746
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse]

Researcher

More Details >

Happy Addons for Elementor <= 3.49.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85006
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]

Researcher

More Details >

JetEngine <= 3.8.14.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97238
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetTricks <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-93618
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

JetTricks [jet-tricks]

Researcher

More Details >

JSM Show Post Metadata <= 4.9.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-88997
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

JSM Show Post Metadata [jsm-show-post-meta]

Researcher

More Details >

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.85 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96835
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

Live Composer <= 2.1.21 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘dslc_module_downloads_output’ Shortcode Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-16778
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Live Composer – Free WordPress Website Builder [live-composer-page-builder]

Researcher

More Details >

Ocean Extra <= 2.6.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94684
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Ocean Extra [ocean-extra]

Researcher

More Details >

Optima Express 8.6.0 – 8.7.5 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96899
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Optima Express IDX [optima-express]

Researcher

More Details >

Optimole 4.0.0 – 4.2.12 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96531
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

More Details >

Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.69.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94674
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing [woocommerce-google-adwords-conversion-tracking-tag]

Researcher

More Details >

PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 11.4.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-95530
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite]

Researcher

More Details >

Podcast Importer SecondLine <= 1.5.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94682
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Podcast Importer SecondLine [podcast-importer-secondline]

Researcher

More Details >

PowerPress <= 11.17.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97319
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

More Details >

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94168
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]

Researcher

More Details >

Premium Blocks – Gutenberg Blocks, Patterns & Templates <= 2.3.17 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94118
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Premium Blocks – Gutenberg Blocks, Patterns & Templates [premium-blocks-for-gutenberg]

Researcher

More Details >

Real3D Flipbook Lite <= 5.3 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-15696
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Real3D Flipbook [real3d-flipbook]

Researcher

More Details >

Review Slider Pro <= 12.7.11 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84096
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

Review Slider Pro <= 12.7.11 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84095
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

Safe SVG <= 2.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94077
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Safe SVG [safe-svg]

Researcher

More Details >

Subscribe Forms 1.4.1 – 1.6.2 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-91073
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form [wp-subscribe-form]

Researcher

More Details >

Text Styler <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-88788
Patch Status

Unpatched
Published
Sep 22, 2026

Affected Software

Text Styler [text-styler]

Researchers

More Details >

The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates <= 6.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96829
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates [the-plus-addons-for-elementor-page-builder]

Researcher

More Details >

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94680
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid [the-post-grid]

Researcher

More Details >

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94671
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid [the-post-grid]

Researcher

More Details >

The Post Grid <= 7.9.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84151
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid [the-post-grid]

Researcher

More Details >

ThemeREX Addons < 2.45.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-97236
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

ThemeREX Addons [trx_addons]

Researcher

More Details >

Ultimate FAQ Accordion Plugin <= 2.4.14 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-94391
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Ultimate FAQ Accordion Plugin [ultimate-faqs]

Researcher

More Details >

Ultra Addons for Contact Form 7 <= 3.5.50 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-95586
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]

Researcher

More Details >

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96338
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

More Details >

User Profile Builder <= 4.0.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-93656
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

More Details >

WP Maps <= 4.9.8 – Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13179
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin]

Researcher

More Details >

WP Multilang – Translation and Multilingual Plugin <= 2.4.31 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15731
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

WP Multilang – Translation and Multilingual Plugin [wp-multilang]

Researchers

More Details >

WPeMatico RSS Feed Fetcher <= 2.8.25 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-89005
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

More Details >

WPeMatico RSS Feed Fetcher <= 2.8.25 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-89002
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

More Details >

WPeMatico RSS Feed Fetcher <= 2.8.26 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-89003
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

More Details >

WPeMatico RSS Feed Fetcher <= 2.8.26 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-89000
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

More Details >

WPeMatico RSS Feed Fetcher <= 2.8.26 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-89006
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

More Details >

wpForo Forum <= 3.1.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-93772
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

wpForo Forum <= 3.1.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘telegram’ Profile Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-93747
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

YouTube Lyte <= 1.7.30 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-96895
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

WP YouTube Lyte [wp-youtube-lyte]

Researcher

More Details >

All-In-One Security (AIOS) – Security and Firewall <= 5.4.8 – Authenticated (Subscriber+) Security Control Bypass

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-96825
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

All-In-One Security (AIOS) – Security and Firewall [all-in-one-wp-security-and-firewall]

Researcher

More Details >

Estatik Real Estate Plugin <= 4.3.5 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-96350
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Estatik Real Estate Plugin [estatik]

Researcher

More Details >

Import and export users and customers <= 2.5.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-94178
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Authenticated (Subscriber+) HTML Injection

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-81338
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.7.2 – Authenticated (Shop Worker+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-97245
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

More Details >

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 – Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-95523
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

More Details >

WPeMatico RSS Feed Fetcher <= 2.8.26 – Authenticated (Contributor+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-89001
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

More Details >

Booking Calendar <= 11.8.3 – Reflected Cross-Site Scripting via ‘wpbc_auto_fill’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-93655
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

JetFormBuilder <= 3.6.5.3 – Reflected Cross-Site Scripting via ‘jfb_xss’ (URL Query Variable) Parameter via Calculated Field

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92212
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Link Library <= 7.9.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-78393
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Link Library [link-library]

Researcher

More Details >

Multiple elFinder Plugins <= 8.0.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-85081
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

File Manager Pro – Filester [filester]
FileOrganizer – WordPress File Manager [fileorganizer]
File Manager [wp-file-manager]

Researcher

More Details >

SSL Zen <= 4.7.42 – Reflected Cross-Site Scripting via ‘uri’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-17577
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

SSL Zen — SSL Certificate Installer & HTTPS Redirects [ssl-zen]

Researcher

More Details >

WPForms <= 2.0.2 – Reflected Cross-Site Scripting via ‘page_title’ POST Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-88996
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

Asset CleanUp: Page Speed Booster <= 1.4.0.5 – Authenticated (Administrator+) Server-Side Request Forgery via ‘page_url’ Parameter

5.5

CVSS Rating
5.5 (Medium)
CVE-ID

CVE-2026-12037
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Asset CleanUp: Page Speed Booster [wp-asset-clean-up]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 – Unauthenticated Blind Server-Side Request Forgery via ‘kirki_data’ Parameter

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-18335
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

10Web Booster <= 2.33.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82195
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]

Researcher

More Details >

AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.7.8 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-93623
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

More Details >

AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) <= 3.15.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94498
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) [appmysite]

Researcher

More Details >

Better Payment <= 2.3.3 – Unauthenticated Payment Manipulation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-77765
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More [better-payment]

Researcher

More Details >

Blocksy Companion <= 2.1.55 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97247
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Blocksy Companion [blocksy-companion]

Researcher

More Details >

Bookly <= 28.2 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86837
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Bookly <= 28.2 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86838
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Captcha Code <= 3.32 – Unauthenticated Login Captcha Protection Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94457
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Captcha Code [captcha-code-authentication]

Researcher

More Details >

Conekta Payment Gateway <= 6.2.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95527
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Conekta Payment Gateway [conekta-payment-gateway]

Researcher

More Details >

Customer Reviews for WooCommerce <= 5.120.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96823
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Customer Reviews for WooCommerce [customer-reviews-woocommerce]

Researcher

More Details >

Directorist 8.1 – 8.9.4 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84026
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]

Researcher

More Details >

Divi Dash <= 1.0.6 – Unauthenticated IP Spoofing to Protection Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-14321
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Divi Dash [divi-dash]

Researcher

More Details >

Easy Hide Login <= 1.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84168
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Easy Hide Login [easy-hide-login]

Researcher

More Details >

Email Subscribers by Icegram Express <= 5.9.34 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-83555
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress [email-subscribers]

Researcher

More Details >

File Manager 7.2.2 – 8.0.4 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-19708
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

File Manager [wp-file-manager]

Researcher

More Details >

FluentBoards 1.95 – 2.0.15 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89331
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

More Details >

Forminator Forms <= 1.57.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87074
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Forminator Forms <= 1.57.2.0 – Missing Authorization to Unauthenticated Arbitrary Post Meta Injection

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87071
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Forminator Forms <= 1.57.2.0 – Unauthenticated Poll Vote Limit Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87070
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97066
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 – Unauthenticated User Impersonation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97196
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Handily <= 1.0.3 – Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via ‘stripe_publishbale_key’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-14487
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Handily [handily]

Researcher

More Details >

Image Buzz <= 1.0.3 – Missing Authorization to Unauthenticated Arbitrary API Key Modification via ‘pixabay_api’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-14484
Patch Status

Unpatched
Published
Sep 21, 2026

Affected Software

Image Buzz [image-buzz]

Researcher

More Details >

Mailchimp for WooCommerce <= 6.2 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92436
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Mailchimp for WooCommerce [mailchimp-for-woocommerce]

Researcher

More Details >

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.70 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94080
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Missing Authorization to Account Registration

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88846
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

Netgsm <= 2.10.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95514
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Netgsm [netgsm]

Researcher

More Details >

Newsletters <= 4.18.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-16264
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

NP Quote Request for WooCommerce <= 2.4.15 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-93528
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

NP Quote Request for WooCommerce [woo-rfq-for-woocommerce]

Researcher

More Details >

Online Booking & Scheduling Calendar by vcita <= 4.6.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95513
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Online Booking & Scheduling Calendar by vcita [meeting-scheduler-by-vcita]

Researcher

More Details >

Online Scheduling and Appointment Booking System – Bookly <= 28.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96348
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Online Scheduling and Appointment Booking System <= 28.2 – Unauthenticated Authorization Bypass via PHP Type Juggling via ‘verification_code’ Parameter Type Juggling via json_data

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92799
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Optima Express 8.5.0 – 8.7.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96897
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Optima Express IDX [optima-express]

Researcher

More Details >

Paid Member Subscriptions <= 3.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90951
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

More Details >

Paid Member Subscriptions <= 3.0.0 – Unauthenticated CAPTCHA Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90950
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

More Details >

Paymattic <= 4.6.25 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89411
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management [wp-payment-form]

Researcher

More Details >

Payment Plugins for PayPal WooCommerce <= 2.0.26 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-80342
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Payment Plugins for PayPal WooCommerce [pymntpl-paypal-woocommerce]

Researchers

More Details >

Paymob for WooCommerce <= 4.1.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87979
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Paymob for WooCommerce [paymob-for-woocommerce]

Researcher

More Details >

Paymob for WooCommerce <= 4.1.13 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87978
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Paymob for WooCommerce [paymob-for-woocommerce]

Researcher

More Details >

PayPlus Payment Gateway <= 8.2.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-93620
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

PayPlus Payment Gateway [payplus-payment-gateway]

Researcher

More Details >

PixelPlay <= 1.0.2 – Missing Authorization to Unauthenticated Arbitrary API Key Deletion via ‘clear_api_type’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-14486
Patch Status

Unpatched
Published
Sep 21, 2026

Affected Software

PixelPlay [pixelplay]

Researcher

More Details >

PostX <= 5.0.40 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86783
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Post Grid Gutenberg Blocks – PostX [ultimate-post]

Researcher

More Details >

Premium Packages <= 7.2.0 – Unauthenticated Forged Payment and Subscription Events

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-93511
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

More Details >

Recipe Maker 9.8.0 – 10.8.1 – Unauthenticated Arbitrary User Meta Corruption

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86608
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

Sale Booster 7.0.0 – 7.5.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88929
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster [easy-sale-badges-for-woocommerce]

Researcher

More Details >

Simply Schedule Appointments <= 1.6.12.29 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94074
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

More Details >

Simply Schedule Appointments <= 1.6.12.31 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94673
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

More Details >

Sprout Invoices – Client Invoicing & Estimates <= 20.8.17 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-97078
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]

Researcher

More Details >

Tangible: Loops & Logic <= 4.2.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95604
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Tangible: Loops & Logic [tangible-loops-and-logic]

Researcher

More Details >

Team – Team Members Showcase Plugin <= 6.0.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95592
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Team – Team Members Showcase Plugin [tlp-team]

Researcher

More Details >

Team Showcase Supreme <= 9.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11871
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Team Members [tc-team-members]

Researcher

More Details >

Testimonials Widget <= 4.0.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-96532
Patch Status

Unpatched
Published
Sep 24, 2026

Affected Software

Testimonials Widget [testimonials-widget]

Researcher

More Details >

The Events Calendar 4.5 – 6.17.4.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84741
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researcher

More Details >

TrustedLogin Connector <= 2.0.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95600
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

TrustedLogin Connector [trustedlogin-connector]

Researcher

More Details >

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 – Unauthenticated Unauthorized User Registration

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95524
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

More Details >

Verge3D <= 4.13.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92995
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Verge3D Publishing and E-Commerce [verge3d]

Researcher

More Details >

Verge3D 4.1.0 – 4.13.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92996
Patch Status

Unpatched
Published
Sep 25, 2026

Affected Software

Verge3D Publishing and E-Commerce [verge3d]

Researchers

More Details >

Verify API <= 1.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89300
Patch Status

Unpatched
Published
Sep 25, 2026

Affected Software

WP Verify API [wp-verify-api]

Researcher

More Details >

WP User Manager – User Profile Builder & Membership <= 2.9.19 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-94079
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]

Researcher

More Details >

WPC Smart Compare for WooCommerce <= 6.6.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90985
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WPC Smart Compare for WooCommerce [woo-smart-compare]

Researcher

More Details >

WPForms Lite 1.8.8.2 – 2.0.1.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-74991
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]

Researcher

More Details >

wpForo Forum 3.0.0 – 3.1.5 – Unauthenticated AI Credit Exhaustion

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-80514
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

YITH Request a Quote for WooCommerce < 4.46.1 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-95602
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

YITH Request a Quote for WooCommerce [yith-woocommerce-request-a-quote]

Researcher

More Details >

Admin Notices Manager <= 1.6.0 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-96827
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Admin Notices Manager [admin-notices-manager]

Researcher

More Details >

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.0 – Authenticated (Shop Manager+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-95522
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

More Details >

Email Log <= 2.63 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-94174
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Email Log [email-log]

Researcher

More Details >

Estatik Real Estate Plugin <= 4.3.5 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-96345
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Estatik Real Estate Plugin [estatik]

Researcher

More Details >

HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.3 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-94117
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

HashBar – Announcement, Notification Bar & Popup Campaign [hashbar-wp-notification-bar]

Researcher

More Details >

Product Feed Manager for WooCommerce <= 6.6.43 – Authenticated (Shop Manager+) Path Traversal to File Deletion via ‘provider’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-15095
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels [webappick-product-feed-for-woocommerce]

Researcher

More Details >

Simple Discount Rules for Woocommerce <= 5.18 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-96828
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Simple Discount Rules for Woocommerce [woo-product-category-discount]

Researcher

More Details >

SSL Zen <= 4.7.42 – Authenticated (Administrator+) Path Traversal to Arbitrary File Read via ‘file_name’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-17602
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

SSL Zen — SSL Certificate Installer & HTTPS Redirects [ssl-zen]

Researcher

More Details >

Ultimeter – the Ultimate Progress and Goals Meter <= 3.0.8 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-95593
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Ultimeter – the Ultimate Progress and Goals Meter [ultimeter]

Researcher

More Details >

W4 Post List <= 3.0.6 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-96826
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

W4 Post List [w4-post-list]

Researcher

More Details >

Hostel <= 1.1.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘custom_currency’ Parameter and Localization file URL Setting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-1645
Patch Status

Unpatched
Published
Sep 21, 2026

Affected Software

Hostel [hostel]

Researcher

140bd95361e8450fe8b798cc5ba97c8aBee

More Details >

Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97079
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Appointment Booking Plugin & Scheduling System – Webba Booking Calendar [webba-booking-lite]

Researcher

More Details >

Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96838
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification [wc-blacklist-manager]

Researcher

More Details >

Blacklist Manager for WooCommerce 1.3.0 – 2.3.1 – Blocked User Restriction Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88828
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification [wc-blacklist-manager]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 – Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92829
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Booking Manager <= 2.1.20 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91025
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar [booking-manager]

Researcher

More Details >

Bookly <= 28.2 – Authenticated (Staff+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-86839
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.27 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94173
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Business Directory Plugin – Easy Listing & Member Directories for WordPress [business-directory-plugin]

Researcher

More Details >

CMB2 <= 2.12.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-80338
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

CMB2 [cmb2]

Researcher

More Details >

Custom Field Template <= 2.7.8 – Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via ‘file_field’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12995
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Custom Field Template [custom-field-template]

Researcher

More Details >

Directorist <= 8.9.4 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84150
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]

Researcher

More Details >

Directorist 3.1.0 – 8.9.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84098
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]

Researcher

More Details >

Directorist 8.5 – 8.9.4 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-77766
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]

Researcher

More Details >

Directorist 8.9.1 – 8.9.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84027
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]

Researcher

More Details >

Event Booking Manager for WooCommerce 5.3.6 – 5.7.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91077
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

More Details >

Events Manager <= 7.4.4 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93661
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]

Researcher

More Details >

Events Manager 7.4.1 – 7.4.4 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93662
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]

Researcher

More Details >

Fluent Support – Helpdesk & Customer Support Ticket System <= 2.3.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94679
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]

Researcher

More Details >

Forminator Forms <= 1.57.2.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87069
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96834
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Link Library <= 7.9.5 – Authenticated (Contributor+) Path Traversal

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-78394
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Link Library [link-library]

Researcher

More Details >

MailerLite – Signup forms (official) <= 1.7.21 – Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-3253
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

MailerLite – Signup forms (official) [official-mailerlite-sign-up-forms]

Researcher

More Details >

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93344
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]

Researcher

More Details >

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93343
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]

Researcher

More Details >

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93342
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]

Researcher

More Details >

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 – Missing Authorization to Authenticated (Subscriber+) Refund Requests

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93341
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]

Researcher

More Details >

Masteriyo LMS <= 3.4.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82850
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

Masteriyo LMS <= 3.4.1 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82849
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81339
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88845
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88847
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Unauthenticated (Subscriber+) Unauthorized Course Enrollment

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88848
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

MCP Server for WordPress <= 1.8.1 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96526
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub]

Researcher

More Details >

MCP Server for WordPress <= 1.8.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96524
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub]

Researcher

More Details >

MCP Server for WordPress <= 1.8.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96525
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub]

Researcher

More Details >

NextScripts: Social Networks Auto-Poster <= 4.4.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-97227
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

NextScripts: Social Networks Auto-Poster [social-networks-auto-poster-facebook-twitter-g]

Researcher

More Details >

Online Scheduling and Appointment Booking System – Bookly <= 28.2 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-96347
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

OpenStation <= 1.1.7 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-19775
Patch Status

Patched
Published
Sep 24, 2026

Affected Software

OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin [desktop-mode]

Researcher

More Details >

Paymob for WooCommerce <= 4.1.13 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87981
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Paymob for WooCommerce [paymob-for-woocommerce]

Researcher

More Details >

Points and Rewards for WooCommerce <= 2.10.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93510
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Points and Rewards for WooCommerce [points-and-rewards-for-woocommerce]

Researcher

More Details >

PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.50.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94487
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced]

Researcher

More Details >

Real3D Flipbook Lite <= 5.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-86842
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Real3D Flipbook [real3d-flipbook]

Researcher

More Details >

Recipe Maker <= 10.8.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-86603
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

Recipe Maker 10.3.0 – 10.8.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-86602
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

RW Elephant Rental Inventory <= 2.3.13 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via ‘toggle_cache’ AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-4123
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

RW Elephant Rental Inventory [rw-elephant-rental-inventory]

Researcher

More Details >

Safe SVG <= 2.5.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-94672
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Safe SVG [safe-svg]

Researcher

More Details >

SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.7 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93513
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP [siteskite]

Researcher

More Details >

Spectra Legacy – Gutenberg Blocks <= 2.20.0 – Authenticated (Contributor+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-16302
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]

Researcher

More Details >

The Events Calendar 6.15.0 – 6.17.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84742
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researcher

More Details >

The Events Calendar 6.15.16.1 – 6.17.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84743
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researcher

More Details >

ThumbPress <= 6.2.1 – Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7622
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More [image-sizes]

Researcher

More Details >

Tutor LMS <= 4.0.7 – Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via ‘payload’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18439
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

UpdraftPlus 1.23.8 – 1.26.7 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82841
Patch Status

Patched
Published
Sep 25, 2026

Affected Software

UpdraftPlus: WP Backup & Migration Plugin [updraftplus]

Researcher

More Details >

WC Fields Factory <= 4.1.10 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93508
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WC Fields Factory [wc-fields-factory]

Researcher

More Details >

WC Fields Factory <= 4.1.10 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93507
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WC Fields Factory [wc-fields-factory]

Researcher

More Details >

WP User Manager <= 2.9.18 – Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18345
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]

Researcher

More Details >

WP-CRM System <= 3.4.6 – Authenticated (Contributor+) Exposure of Sensitive Information via ‘contact_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9004
Patch Status

Unpatched
Published
Sep 21, 2026

Affected Software

WP-CRM System – Manage Clients and Projects [wp-crm-system]

Researcher

More Details >

WPeMatico RSS Feed Fetcher <= 2.8.25 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89004
Patch Status

Patched
Published
Sep 22, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

More Details >

wpForo Forum <= 3.1.5 – Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91092
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent <= 2.7.0 – Missing Authorization to Authenticated (Contributor+) Unauthorized Post and Media Modification

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-93529
Patch Status

Patched
Published
Sep 23, 2026

Affected Software

WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent [wsp-mcp-ai-agents-connector]

Researcher

More Details >

Zportals <= 6.4.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18365
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Zportals [zportals]

Researcher

More Details >

Zportals <= 6.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18364
Patch Status

Patched
Published
Sep 21, 2026

Affected Software

Zportals [zportals]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026) appeared first on Wordfence.

]]> Quarterly WordPress Threat Intelligence Report – Q2 2026 https://swiftupdates.ca/quarterly-wordpress-threat-intelligence-report-q2-2026/ Tue, 29 Sep 2026 19:14:32 +0000 https://swiftupdates.ca/quarterly-wordpress-threat-intelligence-report-q2-2026/

As the leader in WordPress security, Wordfence provides unparalleled security coverage that fully encompasses protection, active monitoring, detection, and response all built around our threat intelligence, demonstrating a strong commitment to security. Our mission is to ensure comprehensive defense-in-depth for every layer of a WordPress website’s security.

It’s important to understand that a complete security solution requires both protection and detection; while protection is crucial for preventing initial compromises, detection is equally vital for a wholesome WordPress site security strategy.

📢 There’s a Wordfence Option for Every Site Owner

Whether you run a personal blog or manage hundreds of client websites, Wordfence has a plan tailored to your needs:

Wordfence Free – Industry-leading Web Application Firewall (WAF) blocking 95% of known threats out of the box, malware scanning, Two-Factor Authentication (2FA), and more. 30-day delay on malware signatures and new firewall rules.

Wordfence Premium – Real-time firewall and malware signature updates, plus powerful tools like an audit log for deeper insight and monitoring.

Wordfence Care – Around-the-clock monitoring by our team, hands-on remediation if something goes wrong, and priority support for true peace of mind.

Wordfence Response – All the benefits of Wordfence Premium and Care with one hour response times for immediate remediation of security breaches.

👉 Compare Plans

This regular report highlights trends and changes in the WordPress security landscape, empowering you as a site owner to proactively protect your website against current vulnerabilities and threats, and to better understand the protections Wordfence provides through it’s robust threat intelligence.

Threat Intelligence Key Highlights Q2 2026

As the industry leader in WordPress security we have access to attack telemetry and vulnerability intelligence that no other security provider can compare to. We know exactly what vulnerabilities will become a target for threats, what the biggest threats to WordPress are, and how to prioritize remediation and protection against WordPress. The following presents some key highlights of WordPress threats and vulnerabilities in Q2 2026.

Total Vulnerabilities Published
2,073
-24.3% from previous quarter
High Threat Vulnerabilities
182
+15.2% from previous quarter
Common & Dangerous Vulnerabilities
357
+80.3% from previous quarter
WAF Attacks Blocked
10.4B
+14.3% from previous quarter
Brute Force Attacks Blocked
18.2B
+13.8% from previous quarter
Sites Infected
573K
+21.0% from previous quarter
👉 What this means for site owners: Keep plugins and themes updated regularly, enable 2FA, run regular security scans, follow strong password security, and rely on a WAF like Wordfence for protection before vulnerabilities are patched and continuous monitoring.

Wordfence Vulnerability Intelligence Highlights for Q2 2026

This section breaks down the vulnerabilities disclosed in Q2 2026 along with highlighting any trends or changes from the previous quarter.

The Wordfence Bug Bounty Program’s primary mission is to attract the highest quality vulnerability research in the WordPress space based on high impact and high severity vulnerabilities that are the most likely to be exploited. Due to this, you can rest assured knowing that you have the best protection available for vulnerabilities that pose the most significant risk to your site before they are even disclosed to the vendor.

Did you know? Wordfence provides the most comprehensive vulnerability intelligence for WordPress, with over 29,000 known vulnerabilities cataloged in our database. Our team adds dozens to hundreds of new vulnerabilities every week, ensuring the Wordfence plugin’s vulnerability scanner, and our free Vulnerability Intelligence API, alert you the moment a new vulnerability is detected.

Total Vulnerabilities Published
2,073
-24.3% from previous quarter
Total WAF Rules Released
16
-27.3% from previous quarter

Total Vulnerabilities Published

In Q2, there were 2,073 vulnerabilities added to the Wordfence Intelligence vulnerability database. Wordfence was responsible for remediating and disclosing 47.4% of the total. The following chart highlights the trend in new vulnerabilities disclosed over this period.

Total Vulnerabilities Trend

Total High Threat Vulnerabilities Published

In Q2, there were 182 high threat vulnerabilities added to the Wordfence Intelligence vulnerability database. These vulnerabilities pose the most significant threat to WordPress websites as attackers are very likely to target them in the real-world, and they can generally lead to full site compromise with minimal requirements. Often generic, or non-WordPress specific firewalls do not provide adequate protection against these vulnerabilities. Wordfence was the source of disclosure for 53.3% of those vulnerabilities, highlighting how the Wordfence firewall can provide you with the fastest protection for WordPress vulnerabilities that pose the most significant risk to your WordPress site.

High Threat Trend

Total Common and Dangerous Vulnerabilities Published

In Q2, there were 357 common and dangerous vulnerabilities added to the Wordfence Intelligence vulnerability database. Wordfence was responsible for remediating and disclosing 32.2% of these common and dangerous vulnerabilities. These vulnerabilities are some of the most commonly found in WordPress plugins and themes, but are still prime targets for attackers who are looking for low hanging fruit to exploit.

Common & Dangerous Trend

Patch Status of Reported Vulnerabilities

At the end of Q2, there were 149 vulnerabilities that remained unpatched. This highlights the importance of utilizing a security scanner like Wordfence that will alert you when an unpatched vulnerability is present on your site so you can take remedial action, like removing the software, immediately.

Patch Status of Published Vulnerabilities

Install Count Distribution of Affected Software

The following highlights the average distribution of install counts for software affected by vulnerabilities reported in this quarter.

Install Count Distribution of Published Vulnerabilities

Authentication Level To Exploit Distribution

Most vulnerabilities disclosed in Q2 required unauthenticated access to exploit. This is the same from Q1 2026 where unauthenticated access was required to exploit for the majority of vulnerabilities published.

Authentication Level Distribution of Published Vulnerabilities

Affected Software Type Distribution (Plugins/Themes/Core)

As usual, the majority of the vulnerabilities disclosed in Q2 were plugin related vulnerabilities.

Software Type Distribution of Published Vulnerabilities

Top 10 Vulnerability Classes Published

The following highlights the most commonly published vulnerabilities in Q2 2026.

Vulnerability Type Total Vulns
CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 600
CWE 862: Missing Authorization 416
CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 213
CWE 352: Cross-Site Request Forgery (CSRF) 121
CWE 502: Deserialization of Untrusted Data 103
CWE 98: Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 101
CWE 200: Exposure of Sensitive Information to an Unauthorized Actor 87
CWE 639: Authorization Bypass Through User-Controlled Key 85
CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 76
CWE 434: Unrestricted Upload of File with Dangerous Type 51

Vendors Registered for the Vulnerability Management Portal

This quarter, we had 133 vendors sign up to manage their WordPress software’s security through the Vulnerability Management Portal (-11.9% from previous quarter). This covers 412 distinct plugins and themes (-25.6% from previous quarter). Vendors who register for the Wordfence Vulnerability Management Portal demonstrate a strong commitment to WordPress security as they are notified in real-time when a new vulnerability has been discovered or reported in their software. If you’re a WordPress vendor and you’d like to sign up for real-time vulnerability alerts and centralized vulnerability management, get started here.

Total Vendors Registered Over Period
Total Plugins/Themes Registered Over Period

Wordfence Threat Intelligence Summary for Q2 2026

This section highlights the past quarter’s trend among vulnerabilities attackers are targeting and password attacks they are initiating.

Threat intelligence is at the heart of Wordfence’s industry-leading security solutions. As the largest security provider for WordPress, we collect and analyze attack telemetry from millions of sites worldwide. This unparalleled visibility gives us real-time insight into what attackers are targeting and when, empowering us to deliver the fastest and most effective protection for WordPress.

Web Application Firewall (WAF) Attack Data Highlights

Did you know? Wordfence leverages attack telemetry from over 5 million protected websites to continuously strengthen the security features of the Wordfence plugin. Sites running Wordfence Premium, Care, or Response automatically block IP addresses actively engaged in malicious activity across WordPress, even when those attacks don’t target a known vulnerability, keeping your site safe from the latest and emerging threats.

WAF Rule Requests Blocked/Logged
10.4B
+14.3% from previous quarter
Blocked From IP Threat Feed
3.1B
-7.0% from previous quarter
Total WAF Rules Released
16
-27.3% from previous quarter
Unique IPs in WAF Attacks
19.7M
+16.7% from previous quarter
Unique IPs From Blocklist
353K
+58.9% from previous quarter
Unique User Agents
72.9M
+263.7% from previous quarter

Total Requests Blocked and Logged by the Wordfence Firewall Over Q2

The following chart highlights how many exploit and probing requests the Wordfence Firewall has blocked over the course of Q2.

WAF Rule Attacks Blocked Over Period

Top 10 User Agents Engaged in Exploiting Vulnerabilities

The following chart highlights the top 10 user agents that have been used in exploit and enumeration attempts across the network of sites we protect.

User Agents Total Requests
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 1,329,501,815
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 723,929,095
curl/8.7.1 532,032,669
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 408,187,867
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 310,476,820
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 178,527,122
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 150,640,717
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 136,301,524
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 121,666,197
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 113,914,440

 

Top 10 Unique Vulnerabilities Targeted by Attackers

The following section highlights the top 10 unique vulnerabilities being targeted by attackers.

Vulnerability Total Blocked Requests
LiteSpeed Cache <= 6.3.0.1 – Unauthenticated Privilege Escalation 49,711,496
WPGraphQL <= 0.2.3 – Multiple Vulnerable Actions 29,403,849
N-Media Post Front-end Form < 1.1 – Arbitrary File Upload 23,130,942
WooCommerce Payments 4.8.0 – 5.6.1 Authentication Bypass and Privilege Escalation 12,610,278
SureTriggers <= 1.0.78 – Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation 10,602,932
Ninja Forms <= 3.5.7 – Unprotected REST-API to Sensitive Information Disclosure 9,975,128
Rank Math SEO <= 1.0.40.2 – Privilege Escalation via Unprotected REST API Endpoint 7,110,040
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 – Authorization Bypass via type connect-app API 4,890,917
Discount Rules for WooCommerce <= 2.0.2 – Missing Authorization 3,797,139
Envato Elements <= 2.0.10 & Template Kit <= 1.0.13 – Authenticated (Contributor+) Arbitrary File Upload
 1,742,988

 

Top 10 Attacking Countries

The following section highlights the top 10 countries engaged in initiating attacks against WordPress websites.

Top 10 Attacking Countries

Top 10 Attacking IP Addresses

The following are the top 10 IP Addresses engaged in targeting WordPress website vulnerabilities.

IP Address Total Requests
45.88.138.44 134,891,593
82.29.71.9 58,308,453
20.48.232.178 38,644,403
195.178.110.199 35,899,295
45.88.138.45 32,030,607
185.177.72.51 31,906,106
2a06:98c0:3600::103 28,367,983
20.151.131.235 27,429,239
185.177.72.70 26,217,018
185.177.72.49 25,730,566

 

Top 5 “Generic” Vulnerability Types Targeted By Attackers

This section highlights the most attacked common vulnerability types.

Top 5 WAF Rules

Password Attacks Data Highlights

Did you know? Wordfence includes a robust suite of password protection features, all available in the free version of the plugin. Features like Two-Factor Authentication (2FA), blocking logins using known compromised passwords, and preventing brute-force login attempts help safeguard your WordPress users and administrators from unauthorized access.

Brute Force Attacks Blocked
18.2B
+13.8% from previous quarter
Unique IPs in Brute Force
106.2M
+55.9% from previous quarter
Avg Requests Per IP
171
-27.0% from previous quarter

Total Password Attacks Blocked by the Wordfence Firewall Over Q2

The following chart highlights how many password attacks the Wordfence Firewall has blocked over the course of Q2.

Password Attacks Blocked Over Period

Top 10 Countries with the Most Distinctly Unique IP Addresses Engaged in Password Attacks

The following chart highlights countries with the most unique IP addresses originating from them engaged in password attacks.

Top Countries by Total Unique IPs Engaged in Password Attacks

Top 10 Countries with the Highest Volume of Password Attacks Blocked

While the above chart highlights countries with the most unique IP Addresses targeting them. The following chart highlights countries with the most password attack activity based on number of requests, rather than distinctly unique IP Addresses.

Top Countries Engaged in Password Attacks

Password Attacks Blocked by Type

This section highlights what password attack techniques are the most common.

Password Attacks by Type

Wordfence Malware Intelligence Report for Q2 2026

This section highlights common trends and patterns in malware attack data across the sites Wordfence protects.

No security solution would be complete without malware detection or scanning. It’s a critical element to website security that if your site gets hacked, it gets detected so that you can take swift remedial action to protect your business and brand reputation.

Did you know? Wordfence’s Malware Signatures are used to provide protection on your site. They are not just used for detecting a compromise, they are also used for blocking uploads of malicious files that match our malware signatures through the Wordfence Firewall.

Malware Attack Data Highlights

Unique Malware Files
31.6M
+15.2% from previous quarter
Malware Signatures Released
85
-4.5% from previous quarter
Sites with Malware
573K
+21.0% from previous quarter
Avg Infected Files Per Site
49.3
-4.8% from previous quarter
Avg Malware Variations Per Site
2.2
-7.8% from previous quarter

Number of Distinct Sites With Malware Detected Over Q2

The following chart highlights the average amount of sites with at least once piece of malware detected over the course of Q2.

Total Number of Distinct Sites With Malware Each Day

Malware Detected by File Type

The following chart highlights the most commonly detected malware based on file type. PHP files are often associated with webshells, backdoors, infostealers, and skimmers while files like JavaScript and HTML are often associated with spam.

Most Commonly Detected Malware File Types

Malware Detected Based on Uploaded Location

The following chart highlights where malware is most commonly uploaded.

Common Malware Locations

Report Archives for Q2 2026

Access the complete collection of detailed vulnerability and bug bounty reports published during Q2 2026. These archives provide comprehensive documentation of all security issues identified and addressed throughout the quarter.

Weekly Vulnerability Report Archive

In case you missed any of the weekly vulnerability reports from Q2, you can find the complete list of them here:

Monthly Bug Bounty Report Archive

If you missed any of the monthly Bug Bounty Program Reports from Q2, you can find those all here:

Conclusion: Key Takeaways For Site Owners

When it comes to securing your WordPress site, a defense-in-depth strategy is essential. No single solution can stop every attack, but by layering protection, detection, and active monitoring, you dramatically reduce your risk and increase your ability to respond quickly when threats emerge.

Protection

The first line of defense is preventing attacks from succeeding in the first place. A strong firewall, timely vulnerability patches, and hardened configurations help block malicious traffic before it ever reaches your site. By leveraging Wordfence’s threat intelligence, you’re protected against the latest exploits that attackers are actively using in the wild. This proactive protection ensures your site is guarded not just against known threats, but against emerging attack patterns.

Detection

Even the best defenses can be tested, which is why detection is critical. Comprehensive scanning helps identify vulnerabilities, malware, or suspicious changes on your site that could signal an attempted compromise. With Wordfence’s real-time scanning powered by global attack data, you gain visibility into threats that may have slipped past other layers of defense, allowing you to act before they cause serious damage.

Active Monitoring

Continuous monitoring serves as your early warning system. Real-time alerts about critical events, login attempts, and file changes help you stay ahead of threats. Wordfence’s comprehensive monitoring doesn’t just tell you something happened, it provides the context and intelligence you need to understand the severity and respond appropriately. This constant vigilance means you’re never flying blind when it comes to your site’s security posture.

Security isn’t a “set it and forget it” task. Active monitoring ensures your site is continuously observed for suspicious behavior, login attempts, and traffic anomalies. Attackers often probe sites for weaknesses over time; having real-time monitoring means you’ll know immediately if your site is being targeted. Wordfence’s monitoring tools provide alerts and insights so you can take swift action, whether that’s blocking an attacker, tightening access, or responding to a detected vulnerability.

By combining protection, detection, and monitoring, you create a strong defense-in-depth strategy for your WordPress site. Wordfence brings all three layers together in one solution, making it simple to secure your site and stay ahead of attackers. Install Wordfence today and put industry-leading security to work for you.

The post Quarterly WordPress Threat Intelligence Report – Q2 2026 appeared first on Wordfence.

]]> Wordfence Bug Bounty Program Monthly Report – June 2026 https://swiftupdates.ca/wordfence-bug-bounty-program-monthly-report-june-2026/ Fri, 25 Sep 2026 17:41:37 +0000 https://swiftupdates.ca/wordfence-bug-bounty-program-monthly-report-june-2026/

In June 2026, the Wordfence Bug Bounty Program received 1066 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordfence Vulnerability Management Portal – a free service for all WordPress vendors, and protected through the Wordfence Firewall where appropriate.

Our mission with the Wordfence Bug Bounty Program is to engage the broader security community in identifying and responsibly disclosing vulnerabilities in WordPress plugins and themes, so we can work with vendors to get them patched before attackers discover them. This collaborative effort enables Wordfence to accelerate patch adoption, provide early protection to millions of websites, and ensure that high-quality vulnerability intelligence reaches the WordPress ecosystem as efficiently as possible. It also ensures that we are able to remediate vulnerabilities before attackers are able to discover them and start exploiting them. That is why we reward researchers for valid submissions, and why we remain committed to processing every report with transparency, accuracy, and urgency.

🔍 Join the Wordfence Bug Bounty Program

Help secure the WordPress ecosystem while earning rewards for your security research.

We’re actively seeking skilled researchers to identify vulnerabilities in WordPress plugins and themes, with prompt payments and transparent processes.

As the most comprehensive and highest-quality WordPress vulnerability program, the Wordfence Bug Bounty Program plays a critical role in helping site owners, developers, and hosting providers stay ahead of emerging threats at all stages of the open source lifecycle.

In this report, we highlight key metrics of the Bug Bounty Program from June 2026, recognize the researchers contributing to WordPress security, and provide insight into the vulnerabilities uncovered and addressed.

Table of Contents
📊 Program Submission Highlights – June 2026
🔍 WordPress Software Vulnerability Submission Insights – June 2026
💰 Bounty Insights – June 2026
🌟 Top WordPress Security Researchers – June 2026
📣 Current WordPress Bug Bounty Program Promotions
🔦 Critical WordPress Software Vulnerability Highlights – June 2026
📝 Conclusion

 

If you’re interested in joining the program or learning more about how we responsibly manage disclosures and protect WordPress users, visit the Bug Bounty Program page.

🔍 WordPress Software Vendors – Sign Up For Free Centralized Management of all Vulnerabilities in Your Software

Wordfence provides a completely free vulnerability management portal for WordPress Software vendors to easily track and manage all vulnerabilities submitted to the Wordfence Bug Bounty Program, and added to the Wordfence Intelligence Vulnerability Database.

This portal streamlines and enhances the repsonsible disclosure process so you can secure your customers faster.

 

📊 Program Submission Highlights – June 2026

The Wordfence Bug Bounty Program is designed for momentum: rapid triage of critical issues, clear feedback, and fast, fair rewards. Each submission moves through our standardized workflow of validation, vendor coordination, patch verification, and firewall coverage where applicable, so research translates into real-world protection quickly.

🛡 Real-Time Protection Impact

Every vulnerability disclosed through this program is a threat you don’t have to face blindly. Our researchers uncover and report vulnerabilities before they can be exploited, and Wordfence Premium, Care and Response users get protection in real-time through our firewall. Free users are protected in 30 days.

Behind the numbers is meaningful impact for site owners. The issues surfaced here inform new firewall rules, strengthen our detection logic, and help vendors ship safer releases. If you’re new to bounty hunting, this is a great place to start: we publish scope clearly, pay promptly, and credit the work that keeps WordPress secure.

📈

Total Submissions

1066
-2.6% from last month
👥

Active Researchers

306
+4.4% from last month
🚨

High Threat

58
+65.7% from last month
⚠

Common & Dangerous

45
+18.4% from last month
🛡

WAF Rules Released

7
+16.7% from last month

 

🎯 Vulnerability Focus Areas

  • 🚨 High Threat Vulnerabilities: Issues that could result in full site compromise, such as Arbitrary File Uploads or Remote Code Execution. Must be exploitable by unauthenticated or low-level authenticated attackers with software having 25+ active installations.
  • ⚠ Common & Dangerous: Stored Cross-Site Scripting and SQL Injection vulnerabilities exploitable by unauthenticated or low-level authenticated attackers. Software must have 500+ active installations.

💰 Bounty Insights – June 2026

Our research powers real investment back into the community. This section totals bounties and bonuses paid for the month and showcases standout findings. Our philosophy is simple: reward high-quality, responsibly disclosed research that measurably reduces risk for WordPress users.

💰

Total Bounties Awarded

$42,553
June 2026
📊

Average Bounty Per Submission

$230.02
Per validated in-scope submission
🏆

Highest Single Bounty

$5,200
Top researcher reward

Top 5 Bounties Awarded

Want to earn more? Read the scope carefully, target high-threat classes, and include clear reproduction steps with proof of impact. We pay promptly on validated issues, and bonus multipliers may apply during limited-time promotions and challenges.

🔍 WordPress Software Vulnerability Submission Insights – June 2026

This section breaks down how reports map to our program outcomes. What’s in scope, what isn’t, and where the highest security impact typically sits. We highlight the most common in-scope vulnerability classes and the categories that yielded the largest rewards so researchers can focus their efforts where they matter most.

Authentication level and exploit preconditions drive risk and reward through our program. Unauthenticated and low-privilege paths tend to have outsized impact because they scale to more real-world compromise. Use these insights to prioritize your testing strategy and maximize both security value and bounty potential.

Total Number of Vulnerabilities Considered In Scope, Out of Scope, Rejected, or Duplicate

In Scope Out of Scope Rejected Duplicate
185 1 578 302

Top 10 Most Commonly Submitted In-Scope Vulnerability Types

The most frequently submitted vulnerability types highlight current testing focus areas across the researcher community. These patterns often reflect both ease of discovery and prevalence in the WordPress ecosystem.

Vulnerability Type Total Submissions Total Rewards Avg. Reward
CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 60 $5,710.00 $95.17
CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 21 $2,488.00 $118.48
CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 20 $1,839.00 $91.95
CWE 269: Improper Privilege Management 15 $4,599.00 $306.60
CWE 434: Unrestricted Upload of File with Dangerous Type 9 $1,995.00 $221.67
CWE 287: Improper Authentication 4 $11,304.00 $2,826.00
CWE 862: Missing Authorization 8 $906.00 $113.25
CWE 639: Authorization Bypass Through User-Controlled Key 5 $207.00 $41.40
CWE 347: Improper Verification of Cryptographic Signature 2 $10,725.00 $5,362.50
CWE 94: Improper Control of Generation of Code (‘Code Injection’) 3 $678.00 $226.00

 

Top 10 Highest Rewarded In-Scope Vulnerability Types

While some vulnerabilities appear frequently, others command premium rewards. This breakdown shows which vulnerability classes generated the highest total payouts across all submissions in those categories, indicating both severity and exploitability value.

Vulnerability Type Total Rewards Total Submissions Avg. Reward
CWE 287: Improper Authentication $11,304.00 4 $2,826.00
CWE 347: Improper Verification of Cryptographic Signature $10,725.00 2 $5,362.50
CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) $5,710.00 60 $95.17
CWE 269: Improper Privilege Management $4,599.00 15 $306.60
CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) $2,488.00 21 $118.48
CWE 434: Unrestricted Upload of File with Dangerous Type $1,995.00 9 $221.67
CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) $1,839.00 20 $91.95
CWE 862: Missing Authorization $906.00 8 $113.25
CWE 94: Improper Control of Generation of Code (‘Code Injection’) $678.00 3 $226.00
CWE 23: Relative Path Traversal $675.00 1 $675.00

In-Scope Vulnerability Distribution by Authentication Level

Authentication requirements directly impact real-world exploitability. Unauthenticated and subscriber-level vulnerabilities typically pose greater risk, reflected in both our prioritization and reward structure.

Authentication Level Total Vulnerabilities Avg. Reward
Unauthenticated 89 $359.80
Subscriber 37 $89.36
Contributor 30 $49.73
Author 15 $18.83
Custom 10 $1,142.67
Unauthenticated – UI Required 7 $116.57

 

Vulnerability Submission Install Count Spread

Install counts help us gauge blast radius. Higher install bases can move a finding into higher priority and often correlate with stronger payouts, while smaller-but-critical ecosystems still qualify when the exploitability and impact warrant it.

Install Range Total Vulnerabilities Average CVSS Avg. Reward
1,000–49,999 63 7.34 $108.00
100,000–999,999 36 6.70 $205.09
Off-Repo 32 8.52 $670.73
0–499 17 8.55 $22.41
50,000–99,999 17 6.58 $209.08
500–999 8 7.45 $26.57
1,000,000–4,999,999 4 7.53 $1,502.25
5,000,000+ 1 6.4 $72.00

 

🌟Top WordPress Security Researchers – June 2026

Security is a team sport, and this leaderboard celebrates the people raising the bar. We recognize contributors by valid in-scope submissions, overall earnings, and average severity to highlight different paths to excellence.

Top 5 Researchers based on Volume of In-Scope Submissions

Volume leaders demonstrate consistent vulnerability discovery across diverse targets. These researchers excel at systematic testing and maintaining high validation rates.

Researcher Total Submissions Avg. Reward
daroo 9 $485.80
Rafie Muhammad 8 $208.13
CHOIGYEONGMIN 8 $21.63
0xd4rk5id3 7 $188.57
Athiwat Tiprasaharn (Jitlada) 6 $14.17

Top 5 Researchers Based on Average CVSS of In-Scope Submissions

Quality over quantity defines these researchers who consistently identify high-severity vulnerabilities. Their average CVSS scores reflect expertise in finding critical security gaps.

Researcher Average CVSS Total Submissions Avg. Reward
Khaled Alenazi (Nxploited) 9.80 2 $390.00
Hieus 9.80 1 $23.00
h0xilo 9.80 1 $342.00
vtim 9.80 1 $5,200.00
Jiemook 9.80 2 $65.50

Top 5 Researchers Based On Total Bounties Earned

Combining volume with severity, these top earners maximized their impact and rewards through strategic vulnerability research and comprehensive reporting.

Researcher Total Earned Total Submissions Avg. Reward
vtim $5,200.00 1 $5,200.00
daroo $4,858.00 9 $539.78
d.v4n_s3c $2,038.00 5 $407.60
sorin vasile $1,950.00 1 $1,950.00
Rafie Muhammad $1,665.00 8 $208.13

Researchers Promoted to the Next Tier

Congratulations to the following researchers who have unlocked the next tier! Tier promotions reflect sustained performance, precision, and professionalism in disclosure. Advancing unlocks higher caps, faster reviews, and more visibility. If you’re climbing the ranks, focus on high risk vulnerabilities, keep reports crisp, attach working PoCs, and include mitigation notes vendors can ship quickly.

Elite Researcher Tier (1337)

0 researchers advanced to elite status
😢
No Elite Researcher Promotions
No researchers advanced to elite (1337) status this month

Resourceful Researcher Tier

0 researchers advanced to resourceful status
😢
No Resourceful Researcher Promotions
No researchers advanced to resourceful status this month

📣 Current WordPress Bug Bounty Program Promotions

As part of our Bug Bounty Program, we regularly launch special promotions that boost bounty rewards and expand research scope. These initiatives are designed to reinforce our mission: delivering the highest quality vulnerability intelligence while encouraging researchers to focus on the discoveries that have the greatest positive impact on the WordPress ecosystem.

At the same time, we also look for promotions that give researchers opportunities to sharpen their skills, take on new challenges, and continue growing into the best of the best in WordPress security research. We often supplement these with educational material for researchers to learn and apply their skills during these promotions.

Below, you’ll find details on all currently active challenges—including timelines and a quick overview of each promotion.

❌ No promotions currently running.

New to promotions? Start by confirming the software and version range are in scope, validate exploitability on a clean test environment, and submit with clear steps, affected code paths, and impact. Promotions are perfect opportunities for both new and seasoned researchers to maximize earnings while driving faster patch adoption. And remember, you can always check what’s in-scope and out-of-scope by using the Wordfence bounty estimator.

🔦 Critical WordPress Software Vulnerability Highlights – June 2026

These case studies spotlight high-impact vulnerabilities uncovered through the program, why they matter, and how quickly protection rolled out. We share technical detail to help researchers learn, vendors harden code, and users understand why timely updates aren’t optional.

If you maintain a site, update to the patched versions listed and ensure Wordfence is active so you benefit from new firewall coverage as it ships. If you’re a researcher, use these write-ups to inform your hunt: patterns repeat, and past root causes often reappear in adjacent code.

🚨 Attackers Actively Exploiting Critical Vulnerability in Everest Forms Pro Plugin

Everest Forms Pro <= 1.9.12 – Unauthenticated Remote Code Execution via Calculation Field

Submitted by:
h0xilo
Bounty Awarded:
$325.00
Technical Details:

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon’s process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the “Complex Calculation” feature.

 

🚨 Attackers Actively Exploiting Critical Vulnerability in Burst Statistics Plugin

Burst Statistics 3.4.0 – 3.4.1.1 – Authentication Bypass to Admin Account Takeover

Submitted by:
Wordfence PRISM
Bounty Awarded:
N/A
Technical Details:

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

 

🚨 Unauthenticated Privilege Escalation Vulnerability Patched in Kirki WordPress Plugin

Kirki 6.0.0 – 6.0.6 – Unauthenticated Privilege Escalation via ‘handle_forgot_password’

Submitted by:
CHOIGYEONGMIN
Bounty Awarded:
$6,436.00
Technical Details:

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

 

🚨 UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) – Unauthenticated Authentication Bypass via UpdraftCentral udrpc

Critical Unauthenticated Authentication Bypass Vulnerability Patched in UpdraftPlus WordPress Plugin

Submitted by:
vtim
Bounty Awarded:
$5,200.00
Technical Details:

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 (free) and versions up to 2.26.5 (premium) via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.

 

🚨 PSA: Supply Chain Compromise Targets ShapedPlugin, Backdoored Pro Plugins Distributed via Official Channels

Multiple ShapedPlugin Plugins < (Various Versions) – Backdoored Software

Submitted by:
Shane
Bounty Awarded:
N/A
Technical Details:

As part of our product lineup, we offer security monitoring and malware removal services to our Wordfence Care and Response customers. In the event of a security incident, our incident response team will investigate the root cause, find and remove malware from your site, and help with other complications that may arise as a result of an infection. During the cleanup, malware samples are added to our Threat Intelligence database, which contains over 4.4 million unique malicious samples. The Wordfence plugin and Wordfence CLI scanner detect over 99% of these samples and indicators of compromise, when using the premium signatures set. Wordfence CLI can scan your site even if WordPress is no longer functional and is an excellent layer of security to implement at the server-level, part of our mission to secure the web by Defense in Depth.

 

🚨 Attackers Actively Exploiting Sensitive Information Exposure Vulnerability in Gravity SMTP Plugin

Gravity SMTP <= 2.1.4 – Unauthenticated Sensitive Information Exposure via REST API

Bounty Awarded:
$800.00
Technical Details:

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin’s register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.

 

🚨 Critical Unauthenticated Arbitrary File Deletion Vulnerability Patched in Avada Builder WordPress Plugin

Avada (Fusion) Builder <= 3.15.3 – Unauthenticated Arbitrary File Deletion via Form Entry Value

Submitted by:
daroo
Bounty Awarded:
$3,600.00
Technical Details:

The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate ‘delete’ cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.

 

📝 Conclusion

WordPress thrives when researchers, vendors, hosts, and site owners pull in the same direction. By funding high-quality research, coordinating responsible disclosure, and shipping firewall rules at scale, Wordfence turns findings into protection for millions of sites.

If you’re a researcher, join the program and submit your next report. If you’re a site owner, update early and often, and run Wordfence to stay ahead of emerging threats. If you’re a vendor, sign up for the vulnerability management portal to receive real-time notifications when new vulnerabilities are reported in your software. Together, we make the WordPress ecosystem safer.

The post Wordfence Bug Bounty Program Monthly Report – June 2026 appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-14-2026-to-september-20-2026/ Thu, 24 Sep 2026 18:58:31 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-14-2026-to-september-20-2026/ Last week, there were 358 vulnerabilities disclosed in 243 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 184 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 311
Unpatched 47

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 4
Medium Severity 262
High Severity 74
Critical Severity 18

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 94
Missing Authorization 68
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 35
Authorization Bypass Through User-Controlled Key 27
Exposure of Sensitive Information to an Unauthorized Actor 26
Improper Privilege Management 19
Improper Control of Generation of Code (‘Code Injection’) 13
Unrestricted Upload of File with Dangerous Type 12
Cross-Site Request Forgery (CSRF) 8
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 8
Client-Side Enforcement of Server-Side Security 7
Server-Side Request Forgery (SSRF) 6
Deserialization of Untrusted Data 4
Improper Authentication 4
Incorrect Authorization 3
Protection Mechanism Failure 3
URL Redirection to Untrusted Site (‘Open Redirect’) 3
Authentication Bypass Using an Alternate Path or Channel 2
Improper Input Validation 2
Insufficient Verification of Data Authenticity 2
Uncontrolled Resource Consumption 2
Authentication Bypass by Spoofing 1
Embedded Malicious Code 1
External Control of File Name or Path 1
Guessable CAPTCHA 1
Improper Authorization 1
Improper Encoding or Escaping of Output 1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) 1
Improper Restriction of Rendered UI Layers or Frames 1
Improper Verification of Cryptographic Signature 1
Insufficiently Protected Credentials 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

25

17

13

12

11

11

11

8

7

6

6

6

6

6

5

5

5

5

5

5

4

4

4

4

4

4

4

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
5a50351dc3a5975487697a55ad3936d5
UKO

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery interactive-3d-flipbook-powered-physics-engine
Active Woot Products Tables for WooCommerce. 100% FREE  profit-products-tables-for-woocommerce
Ad Inserter – Ad Manager & AdSense Ads ad-inserter
Add User Autocomplete add-user-autocomplete
Admin Menu Editor Pro admin-menu-editor-pro
Advanced Custom Fields: Extended PRO acf-extended-pro
Advanced Popups advanced-popups
AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing af-companion
AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine
Album Cover Finder album-cover-finder
All Bootstrap Blocks all-bootstrap-blocks
All-in-One WP Migration and Backup all-in-one-wp-migration
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) appmysite
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint
Appointment Hour Booking – Booking Calendar appointment-hour-booking
Asset CleanUp: Page Speed Booster wp-asset-clean-up
Auto Upload Images auto-upload-images
Autopay platnosci-online-blue-media
aVideo avideo
BE REST Endpoints be-rest-endpoints
BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript searchpro
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots bp-better-messages
BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for News, Magazine & Blogs blockspare
Blog2Social: Social Media Auto Post & Scheduler blog2social
Bold Page Builder bold-page-builder
Booking Calendar booking
Booking for Appointments and Events Calendar – Amelia ameliabooking
Bookit — Booking & Appointment Calendar bookit
Botiga Pro botiga-pro
Bread bread
Breeze Cache breeze
Brizy – Page Builder brizy
Business Name Generator designbro-business-name-generator
Checkout Field Manager (Checkout Manager) for WooCommerce woocommerce-checkout-manager
Choose User Role at Registration for WooCommerce choose-user-role-at-registration
Clean Login clean-login
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors publishpress-authors
Comments Import & Export comments-import-export-woocommerce
Complianz GDPR/CCPA Cookie Consent Banner complianz-gdpr
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery
Cooked – Recipe Management cooked
Create mediavine-create
CSS & JavaScript Toolbox css-javascript-toolbox
Custom Field Template custom-field-template
Custom Twitter Feeds – A Tweets Widget or X Feed Widget custom-twitter-feeds
Datalogics Ecommerce Delivery – Datalogics datalogics
design-scuole-wordpress-theme design-scuole-wordpress-theme
Dewa Kirim – WooCommerce Gojek / Gosend dewa-kirim-woocommerce-gojek
Dictionary dictionary
Divi Essentials divi-essential
Download Manager download-manager
DS Ad Rotator ds-adrotator
Easy Appointments easy-appointments
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder easy-form-builder
Easy Invoice – Invoice Generator, PDF Quotes & Payments easy-invoice
EduAdmin Booking eduadmin-booking
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons bdthemes-element-pack-lite
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents embedpress
Empik for Woocommerce empik-for-woocommerce
Estatik Real Estate Plugin estatik
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar mage-eventpress
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce wp-event-solution
EWWW Image Optimizer ewww-image-optimizer
Export & Import WPBakery Page Builder vc-templates-import-export
FileBird – WordPress Media Library Folders & File Manager filebird
Filter Gallery filter-gallery
Flex Import flex-import
FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login fluent-security
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration fluent-boards
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More formidable
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images foxtool
Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7
GenieWords geniewords
Geo Mashup geo-mashup
Getwid – Gutenberg Blocks getwid
GiveWP – Donation Plugin and Fundraising Platform give
GoPay for WooCommerce gopay-gateway
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI gptranslate
Gravity Forms gravityforms
Gum Addon for Elementor gum-elementor-addon
Headless SSO Plugin for WP headless-single-sign-on
Hide My WP Ghost – Security & Firewall hide-my-wp
Hoo Companion hoo-companion
HT Mega Addons for Elementor – Elementor Widgets & Template Builder ht-mega-for-elementor
Hydra Booking — Appointment Scheduling & Booking Calendar hydra-booking
Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons
IDB Ecommerce (wpStoreCart 5) wpstorecart
iGMS Direct Booking igms-direct-booking
Import and export users and customers import-users-from-csv-with-meta
InfiniteWP Client iwp-client
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms gdpr-compliant-recaptcha-for-all-forms
Issues and Series for Newspapers, Magazines, Publishers, Writers organize-series
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress jeg-elementor-kit
JetBlocks for Elementor jet-blocks
JetBlog jet-blog
JetElements jet-elements
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
JetSearch jet-search
JetTabs jet-tabs
Job Postings job-postings
JWT Authentication for WP REST APIs wp-rest-api-authentication
kboard kboard
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder king-addons
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Kubio AI Page Builder kubio
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
LiteSpeed Cache litespeed-cache
Location Manager geodir_location_manager
Login with QR login-with-qr
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid magazine-blocks
Mailchimp for WooCommerce mailchimp-for-woocommerce
Mapster WP Maps mapster-wp-maps
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits master-addons
Master Blocks – Ultimate Blocks for Marketers ultimate-blocks-for-gutenberg
Master Slider – Responsive Touch Slider master-slider
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MC4WP: Mailchimp for WordPress mailchimp-for-wp
Meow Gallery meow-gallery
MgoSync – European dropshipping and suppliers megamo
Migratico Lite migratico-lite
MoreConvert Wishlist for WooCommerce smart-wishlist-for-more-convert
MotoPress Hotel Booking motopress-hotel-booking-lite
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
Multi Uploader for Gravity Forms gf-multi-uploader
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor
Newsletter newsletter-email-mailing-list
Newsletter – Send awesome emails from WordPress newsletter
Newsletters newsletters-lite
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard ni-woocommerce-sales-report
Nimble Page Builder nimble-builder
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
OTP Login & Register Woocommerce mobile-login-woocommerce
Paid Downloads paid-downloads
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Partial Shipment for WooCommerce wc-partial-shipment
Payment Gateway for PayPal on WooCommerce woo-paypal-gateway
Payment Gateway of Stripe for WooCommerce payment-gateway-stripe-and-woocommerce-integration
PDF Builder for WooCommerce. Create invoices,packing slips and more woo-pdf-invoice-builder
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery
Pochipp pochipp
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder popup-maker
Price Drop Alert for Woo Commerce woo-price-drop-alert
Printcart Store – Web to Print Product Designer for WooCommerce printcart-integration
Private Feed Key private-feed-key
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels best-woocommerce-feed
Product Question and Answer product-question-and-answer
Property Hive propertyhive
PuppyFW puppyfw
Qi Addons For Elementor qi-addons-for-elementor
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes quillforms
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder real3d-flipbook-lite
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) really-simple-ssl
Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit woo-rede
Redux Framework redux-framework
RestroPress – Online Food Ordering System restropress
Robokassa payment gateway for Woocommerce robokassa
Rox Appointment Booking – Appointment Booking Scheduling Solution rox-appointment-booking
Royal Addons for Elementor – Addons and Templates Kit for Elementor royal-elementor-addons
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg rt-mega-menu
SAML Single Sign On – SSO Login miniorange-saml-20-single-sign-on
SAMO Forms samo-forms
Save as PDF Plugin by PDFCrowd save-as-pdf-by-pdfcrowd
Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp
Search Atlas SEO – OTTO AI SEO Automation for WordPress metasync
Secure Custom Fields secure-custom-fields
SEO Booster seo-booster
Seraphinite Accelerator seraphinite-accelerator
Share-one-Drive | OneDrive & SharePoint plugin for WordPress shareonedrive-onedrive-plugin-for-wordpress
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets shopengine
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin woolentor-addons
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel-image-optimiser
Sign-up Sheets sign-up-sheets
Simple Membership simple-membership
SKT Addons for Elementor skt-addons-for-elementor
SSL Zen — SSL Certificate Installer & HTTPS Redirects ssl-zen
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers woocommerce-exporter
Strong Testimonials strong-testimonials
Subscriptions for WooCommerce subscriptions-for-woocommerce
The Pressengine the-pressengine
The Welcomizer the-welcomizer
TikTok tiktok-for-business
To Do List Member todo-lists-for-membership-sites
Tripzzy – Travel Engine System tripzzy
TrueBooker – Appointment Booking and Scheduler System truebooker-appointment-booking
Tutor LMS – eLearning and online course solution tutor
Tz Weekly Radio Schedule tz-wrs-core
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Ultra Addons for Contact Form 7 ultimate-addons-for-contact-form-7
Unbounce Landing Pages unbounce
Unlimited Elements For Elementor unlimited-elements-for-elementor
UpsellWP – Upsell and Related Products Offers for WooCommerce checkout-upsell-and-order-bumps
Use-your-Drive | Google Drive plugin for WordPress use-your-drive
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration
UsersWP – Social Login userswp-social-login
VikBooking Hotel Booking Engine & PMS vikbooking
VikRentItems Flexible Rental Management System vikrentitems
Visitor Traffic Real Time Statistics pro visitors-traffic-real-time-statistics-pro
Visualizer – Tables & Charts Manager with Built-in AI Generator visualizer
VK All in One Expansion Unit vk-all-in-one-expansion-unit
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors wc-vendors
WCFM Marketplace – Multivendor Marketplace for WooCommerce wc-multivendor-marketplace
Web to Print Online Designer web-to-print-online-designer
WordLift – AI powered SEO – Schema wordlift
Wow Elements Addons for Elementor wow-elements-addons-for-elementor
WP Cloud Plugins – Box (Lets-Box) lets-box
WP Cloud Plugins – Dropbox (Out-of-the-Box) out-of-the-box
WP Component wpcomponent
WP Composer – The Easiest Page Builder page-builder-wp
WP Customer Reviews wp-customer-reviews
WP Directory Kit wpdirectorykit
WP Easy Pay – Payment and Donation Form Builder for Square wp-easy-pay
WP images upload on piclect wp-images-upload-on-piclect
WP Import Export Lite wp-import-export-lite
WP Inventory Manager wp-inventory-manager
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings wp-google-map-plugin
WP Mega Menu wp-megamenu
WP Multi Store Locator Pro wp-multi-store-locator-pro
WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals wp-optimizer
WP Photo Album Plus wp-photo-album-plus
WP Recipe Maker wp-recipe-maker
wp shortcut link and advertisement baner wp-shortcut-link
WP-Lister Lite for eBay wp-lister-for-ebay
WP2Social Auto Publish facebook-auto-publish
WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services chatbot
WPComplete wpcomplete
WPGraphQL Smart Cache wpgraphql-smart-cache
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode gdpr-cookie-consent
WPMasterToolKit (WPMTK) – All in one plugin wpmastertoolkit
wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility xagio-seo
Xpro Addons — 150+ Widgets for Elementor xpro-elementor-addons
YayPricing – WooCommerce Dynamic Pricing & Discounts yaypricing
Yo yo
Yogeta WP Cloud yogeta-wp-cloud
YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin youram-youtube-embed
YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress ysleadgen
Zonify – Amazon Product Importer for WooCommerce zonify

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Bridge – Creative Multipurpose WordPress Theme bridge
Consulting – Business, Finance WordPress Theme consulting
Divi Divi
VW Writer Blog vw-writer-blog

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Admin Menu Editor Pro 2.35 – 2.36 – Backdoored Software

9.8

CVSS Rating
9.8 (Critical)
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Admin Menu Editor Pro [admin-menu-editor-pro]

Researcher(s): Unknown

More Details >

Advanced Custom Fields: Extended PRO <= 0.9.2.6 – Unauthenticated Remote Code Execution via Dynamic Render Field Type

9.8

CVSS Rating
9.8 (Critical)
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Advanced Custom Fields: Extended PRO [acf-extended-pro]

Researchers

More Details >

Choose User Role at Registration for WooCommerce <= 1.3.2 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-85128
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Choose User Role at Registration for WooCommerce [choose-user-role-at-registration]

Researcher

More Details >

DS Ad Rotator <= 0.8 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-81402
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

DS Ad Rotator [ds-adrotator]

Researcher

More Details >

Gravity Forms <= 3.1.0.4 – Unauthenticated Arbitrary File Upload via Hidden File Upload Field

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-84434
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Gravity Forms [gravityforms]

Researcher

More Details >

JetFormBuilder <= 3.6.2 – Unauthenticated Privilege Escalation via ‘_jet_engine_booking_form_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12793
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Login with QR <= 1.0.0 – Authentication Bypass

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-86710
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Login with QR [login-with-qr]

Researcher

More Details >

Migratico Lite <= 2.6.8 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-62104
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Migratico Lite [migratico-lite]

Researcher

More Details >

Multi Uploader for Gravity Forms <= 1.1.9 – Unauthenticated Arbitrary File Upload via Chunked File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-87796
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Multi Uploader for Gravity Forms [gf-multi-uploader]

Researcher

More Details >

Private Feed Key <= 0.1 – Authentication Bypass

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-86707
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Private Feed Key [private-feed-key]

Researcher

More Details >

The Pressengine <= 1.0 – Authentication Bypass

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-86709
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

The Pressengine [the-pressengine]

Researcher

More Details >

TrueBooker <= 1.2.3 – Missing Authorization to Unauthenticated Arbitrary User Email Modification via ‘admin_addcustomer’ AJAX Action

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14349
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

More Details >

Ultimate Addons for Contact Form 7 3.2.4 – 3.5.50 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-84750
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]

Researcher

More Details >

WooCommerce Online Product Designer <= 2.14.0 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-82187
Patch Status

Patched
Published
Sep 19, 2026

Affected Software

Web to Print Online Designer [web-to-print-online-designer]

Researcher

More Details >

WP images upload on piclect <= 1.0 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-84171
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

WP images upload on piclect [wp-images-upload-on-piclect]

Researcher

More Details >

wpShopGermany IT-RECHT KANZLEI <= 2.3 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-88795
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

wpShopGermany IT-RECHT KANZLEI [wpshopgermany-it-recht-kanzlei]

Researcher

More Details >

Forminator Forms <= 1.57.2 – Unauthenticated Arbitrary Shortcode Execution via ‘current_url’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-92229
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

WP Recipe Maker <= 10.8.1 – Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-89274
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

Consulting – Business, Finance WordPress Theme <= 6.7.16 – Authenticated (Subscriber+) Privilege Escalation via AJAX

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-14805
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Consulting – Business, Finance WordPress Theme [consulting]

Researcher

More Details >

Contest Gallery <= 32.0.1 – Unauthenticated Arbitrary File Upload via ‘baseUrlForFacebook’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-78088
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

More Details >

Mapster WP Maps <= 1.23.0 – Authenticated (Subscriber+) Arbitrary User Meta Write via ‘acf-photo-gallery-groups’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12954
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Mapster WP Maps [mapster-wp-maps]

Researcher

More Details >

Save as PDF Plugin by PDFCrowd <= 4.6.1 – Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via ‘pdf_created_callback’ Shortcode Attribute

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-92807
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Save as PDF Plugin by PDFCrowd [save-as-pdf-by-pdfcrowd]

Researcher

More Details >

ShortPixel Image Optimizer <= 6.5.5 – Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-17086
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]

Researcher

More Details >

The Welcomizer <= 2.8.1 – Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via ‘twiz_custom_logic’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-4327
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

The Welcomizer [the-welcomizer]

Researcher

More Details >

WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 – Authenticated (Subscriber+) Arbitrary File Upload via Media Import

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-93031
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Share-one-Drive | OneDrive & SharePoint plugin for WordPress [shareonedrive-onedrive-plugin-for-wordpress]
Use-your-Drive | Google Drive plugin for WordPress [use-your-drive]
WP Cloud Plugins – Box (Lets-Box) [lets-box]
WP Cloud Plugins – Dropbox (Out-of-the-Box) [out-of-the-box]

Researcher

More Details >

Filter Gallery <= 1.1.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via ‘ufg_gallery_id’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-89413
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Filter Gallery [filter-gallery]

Researcher

More Details >

IDB Ecommerce (wpStoreCart 5) <= 5.0.7 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-84099
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

IDB Ecommerce (wpStoreCart 5) [wpstorecart]

Researcher

More Details >

Master Addons for Elementor <= 3.2.2 – Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via ‘popup_id’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-85410
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits [master-addons]

Researcher

More Details >

Paid Downloads <= 3.15 – Unauthenticated Arbitrary File Upload via ‘paiddownloads_update_file’ Action

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-87935
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Paid Downloads [paid-downloads]

Researcher

More Details >

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘eup_bio’ Biography Field (Entity-Encoded Shortcode Bracket)

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-85658
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar]

Researcher

More Details >

Album Cover Finder <= 0.7.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-84047
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

Album Cover Finder [album-cover-finder]

Researcher

More Details >

All Bootstrap Blocks 1.3.20 – 1.3.31 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-88994
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

All Bootstrap Blocks [all-bootstrap-blocks]

Researcher

More Details >

Design Scuole Italia <= 2.18.1 – Unauthenticated Arbitrary File Donwload

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87791
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

design-scuole-wordpress-theme [design-scuole-wordpress-theme]

Researcher(s): Unknown

More Details >

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 – Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-75983
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Location Manager <= 2.3.38 – Unauthenticated SQL Injection via ‘latitude’ and ‘longitude’ REST API Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-85705
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Location Manager [geodir_location_manager]

Researcher

More Details >

Ni WooCommerce Sales Report <= 4.1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-78472
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard [ni-woocommerce-sales-report]

Researcher

More Details >

Online Scheduling and Appointment Booking System <= 28.1 – Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via ‘conversation_id’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89063
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Price Drop Alert for WooCommerce <= 1.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87770
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Price Drop Alert for Woo Commerce [woo-price-drop-alert]

Researcher

More Details >

Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 – Unauthenticated Arbitrary File Read via ‘folder’ and ‘mockups’ Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-14323
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Printcart Store – Web to Print Product Designer for WooCommerce [printcart-integration]

Researcher

More Details >

Product Question and Answer <= 1.1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87771
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Product Question and Answer [product-question-and-answer]

Researcher

More Details >

SAMO Forms <= 1.0.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-80491
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

SAMO Forms [samo-forms]

Researcher

More Details >

Shortcut Link <= 1.2.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87767
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

wp shortcut link and advertisement baner [wp-shortcut-link]

Researcher

More Details >

Tz Weekly Radio Schedule <= 1.8.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87775
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Tz Weekly Radio Schedule [tz-wrs-core]

Researcher

More Details >

Tz Weekly Radio Schedule <= 1.8.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87774
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Tz Weekly Radio Schedule [tz-wrs-core]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.19 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-85017
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

VikRentItems Flexible Rental Management System <= 1.2.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-88926
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

VikRentItems Flexible Rental Management System [vikrentitems]

Researchers

More Details >

WCFM Marketplace <= 3.8.2 – Unauthenticated SQL Injection via ‘wcfmmp_user_location_lat’ / ‘wcfmmp_user_location_lng’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-18442
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]

Researcher

More Details >

WP Multi Store Locator Pro <= 4.5.1 – Unauthenticated SQL Injection via ‘store_locator_search_radius’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-15275
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Multi Store Locator Pro [wp-multi-store-locator-pro]

Researcher

More Details >

WP Photo Album Plus <= 9.2.09.002 – Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87909
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

Yo 1.1 – 1.3.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87963
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Yo [yo]

Researcher

More Details >

Yogeta WP Cloud <= 1.0 – Unauthenticated Arbitrary File Read

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-80494
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

Yogeta WP Cloud [yogeta-wp-cloud]

Researcher

More Details >

YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 – Unauthenticated Information Disclosure in ‘ysleadgen_get_captured_data’ AJAX Action

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-1255
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress [ysleadgen]

Researcher

More Details >

GiveWP <= 4.16.8.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-85530
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Headless SSO Plugin for WP <= 1.7.0 – Unauthenticated Arbitrary Account Takeover

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-62108
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Headless SSO Plugin for WP [headless-single-sign-on]

Researcher

More Details >

SAML Single Sign On <= 5.0.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-82842
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]

Researcher

More Details >

UsersWP – Social Login <= 1.5.9 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-86814
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

UsersWP – Social Login [userswp-social-login]

Researcher

More Details >

WP Component <= 2.2.4 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-85681
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

WP Component [wpcomponent]

Researcher

More Details >

AF Companion <= 2.1.0 – Authenticated (Shop Manager+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84738
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing [af-companion]

Researcher

More Details >

Asset CleanUp: Page Speed Booster <= 1.4.0.5 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13354
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Asset CleanUp: Page Speed Booster [wp-asset-clean-up]

Researcher

More Details >

BE REST Endpoints <= 1.0.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81742
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

BE REST Endpoints [be-rest-endpoints]

Researchers

More Details >

Booking Calendar <= 11.8.2 – Authenticated (Editor+) Privilege Escalation to ‘data_name’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92619
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 – Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-83561
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr]

Researcher

More Details >

Dewa Kirim <= 1.0.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87786
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Dewa Kirim – WooCommerce Gojek / Gosend [dewa-kirim-woocommerce-gojek]

Researchers

More Details >

Dictionary <= 1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88792
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Dictionary [dictionary]

Researchers

More Details >

Easy Form Builder 4.0.0 – 4.1.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85122
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]

Researcher

More Details >

Forminator Forms <= 1.57.2.0 – Authenticated (Admin+) Privilege Escalation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87068
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Generate PDF using Contact Form 7 <= 4.2.1 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90984
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7]

Researcher

More Details >

GenieWords 1.5.27 – 1.5.34 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-74933
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

GenieWords [geniewords]

Researchers

More Details >

Hoo Companion 1.0.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85129
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

Hoo Companion [hoo-companion]

Researchers

More Details >

iGMS Direct Booking <= 1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88825
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

iGMS Direct Booking [igms-direct-booking]

Researcher

More Details >

Import and export users and customers <= 2.5.1 – Authenticated (Admin+) Privilege Escalation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92540
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

Import and export users and customers <= 2.5.1 – Authenticated (Admin+) Privilege Escalation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92541
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-76552
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-76551
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.33 – Authenticated (Admin+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-76550
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Jeg Kit for Elementor <= 3.2.16 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-18405
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]

Researcher

More Details >

Master Blocks 1.4.1 – 1.4.1.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88824
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Master Blocks – Ultimate Blocks for Marketers [ultimate-blocks-for-gutenberg]

Researcher

More Details >

MotoPress Hotel Booking <= 6.2.4 – Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object ‘id’

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90650
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

MotoPress Hotel Booking [motopress-hotel-booking-lite]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Admin+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81650
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

Optimole <= 4.2.11 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84829
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

More Details >

Popup Maker <= 1.24.0 – Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87915
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker]

Researcher

More Details >

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 – Unauthenticated Stored Cross-Site Scripting via Multiple Choice ‘Other’ Value

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-15664
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes [quillforms]

Researcher

More Details >

Royal Elementor Addons <= 1.7.1066 – Unauthenticated Arbitrary HTML Injection in Notification Emails

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13407
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

More Details >

To Do List Member 1.4 – 1.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-86801
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

To Do List Member [todo-lists-for-membership-sites]

Researchers

More Details >

Ultimate Member <= 2.13.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85680
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

VikBooking 1.8.8 – 1.8.14 – Unauthenticated Stored Cross-Site Scripting via SVG Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85127
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

Visitor Traffic Real Time Statistics pro <= 11.21 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90986
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Visitor Traffic Real Time Statistics pro [visitors-traffic-real-time-statistics-pro]

Researcher

More Details >

WordPress Core <= 7.1 – Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93485
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP Inventory Manager <= 2.5.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90887
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

WP Inventory Manager [wp-inventory-manager]

Researcher

More Details >

WP-Lister Lite for eBay <= 3.8.9 – Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-18595
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

WP-Lister Lite for eBay [wp-lister-for-ebay]

Researcher

More Details >

WPLP Cookie Consent <= 4.4.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85130
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin 10.0 – 10.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88793
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin [youram-youtube-embed]

Researcher

More Details >

Forminator Forms <= 1.57.2.0 – Authenticated (Admin+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-87067
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

AI Engine <= 3.7.7 – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via ‘mediaId’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-89141
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

More Details >

Better Messages <= 2.15.33 – Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via ‘/thread/<id>’ REST Endpoint

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-89334
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

Create <= 2.5.3 – Authenticated (Author+) SQL Injection via ‘order_by’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13191
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Create [mediavine-create]

Researcher

More Details >

Create <= 2.5.3 – Authenticated (Author+) SQL Injection via ‘order’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13200
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Create [mediavine-create]

Researcher

More Details >

Custom Field Template <= 2.7.8 – Authenticated (Contributor+) SQL Injection via ‘post_ID’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-9855
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Custom Field Template [custom-field-template]

Researcher

More Details >

Divi Essentials <= 5.8.1 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-15760
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Divi Essentials [divi-essential]

Researcher

More Details >

Download Manager <= 3.3.68 – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via ‘wpdm_duplicate’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-92714
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Easy Appointments <= 3.12.27 – Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-9232
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Formidable Forms <= 6.34 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-19857
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable]

Researcher

More Details >

GiveWP <= 4.16.8 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-85113
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

InfiniteWP Client <= 1.13.9 – Authenticated (Admin+) SQL Injection via ‘iwp_get_comments_*’ Array Key

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-17576
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

InfiniteWP Client [iwp-client]

Researcher

More Details >

JetFormBuilder <= 3.6.5.2 – Authenticated (Administrator+) Arbitrary File Deletion

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-19860
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Photo Gallery by 10Web <= 1.8.44 – Authenticated (Author+) SQL Injection via ‘album_id’ Shortcode Attribute

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-85652
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels <= 7.12.0 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-66580
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels [best-woocommerce-feed]

Researcher

More Details >

Tutor LMS <= 4.0.8 – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via ‘student_id’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-89333
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Wow Elements Addons for Elementor <= 1.11.2 – Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-1641
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Wow Elements Addons for Elementor [wow-elements-addons-for-elementor]

Researchers

More Details >

WP Directory Kit <= 1.5.4 – Authenticated (Custom+) SQL Injection via ‘order_by’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-16588
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

More Details >

WP Inventory Manager <= 2.5.1 – Authenticated (Contributor+) SQL Injection via ‘where’ Shortcode Attribute

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-17607
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Inventory Manager [wp-inventory-manager]

Researcher

More Details >

Advanced Popups <= 1.2.3 – Authenticated (Author+) Stored Cross-Site Scripting via ‘Notification Button Link’ Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11996
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Advanced Popups [advanced-popups]

Researcher

More Details >

All Bootstrap Blocks <= 1.3.31 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-88993
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

All Bootstrap Blocks [all-bootstrap-blocks]

Researcher

More Details >

AppMySite <= 3.15.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13770
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) [appmysite]

Researcher

More Details >

Auto Upload Images <= 3.3.2 – Authenticated (Contributor+) Server-Side Request Forgery via ‘src’ Attribute of <img> Tags

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12106
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Auto Upload Images [auto-upload-images]

Researcher

More Details >

Bold Page Builder <= 5.9.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘shortcode_content’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5920
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Bold Page Builder [bold-page-builder]

Researcher

More Details >

Bridge – Creative Multipurpose WordPress Theme <= 30.8.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘circle_line’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15609
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Bridge – Creative Multipurpose WordPress Theme [bridge]

Researcher

More Details >

Brizy – Page Builder <= 2.8.14 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘rootAttributes’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2585
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Brizy – Page Builder [brizy]

Researchers

More Details >

Custom Twitter Feeds <= 2.8.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘buttoncolor’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84909
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Custom Twitter Feeds – A Tweets Widget or X Feed Widget [custom-twitter-feeds]

Researcher

More Details >

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66574
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

More Details >

Eventin <= 4.1.23 – Authenticated (Custom+) Stored Cross-Site Scripting via ‘etn_shedule_objective’ schedule_slot Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15402
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

EWWW Image Optimizer <= 8.7.6 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-91011
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

EWWW Image Optimizer [ewww-image-optimizer]

Researcher

More Details >

Geo Mashup <= 1.13.21 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-78294
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Geo Mashup [geo-mashup]

Researcher

More Details >

Getwid <= 2.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps ‘customStyle’

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5924
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Getwid – Gutenberg Blocks [getwid]

Researcher

More Details >

Gum Addon for Elementor <= 1.3.15 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘pop_tag’ Widget Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8354
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Gum Addon for Elementor [gum-elementor-addon]

Researcher

More Details >

HT Mega 3.2.0 – 3.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86788
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-76558
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66617
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]

Researcher

More Details >

JetBlocks for Elementor <= 1.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66576
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetBlocks for Elementor [jet-blocks]

Researcher

More Details >

JetBlog <= 2.4.10 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66572
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetBlog [jet-blog]

Researcher

More Details >

JetElements <= 2.9.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66579
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetElements [jet-elements]

Researcher

More Details >

JetSearch <= 3.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66577
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetSearch [jet-search]

Researcher

More Details >

JetTabs <= 2.3.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66573
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetTabs [jet-tabs]

Researcher

More Details >

Job Postings <= 2.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘position_button’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-18063
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Job Postings [job-postings]

Researcher

More Details >

King Addons for Elementor <= 51.1.80 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84902
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

Kirki 6.0.0 – 6.3.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84223
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Kubio AI Page Builder <= 2.8.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14472
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Kubio AI Page Builder [kubio]

Researcher

More Details >

Magazine Blocks <= 1.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘clientId’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-75016
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks]

Researcher

More Details >

Master Slider <= 3.11.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14844
Patch Status

Unpatched
Published
Sep 18, 2026

Affected Software

Master Slider – Responsive Touch Slider [master-slider]

Researcher

More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86311
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Popup Maker <= 1.24.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via post_title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15797
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

Property Hive <= 2.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66578
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Property Hive [propertyhive]

Researcher

More Details >

Real 3D Flipbook <= 5.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘lightboxtext’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15098
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]

Researcher

More Details >

Redux Framework <= 4.5.13 – Authenticated (Subscriber+) Cross-Site Scripting via User Input

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5400
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

More Details >

Redux Framework <= 4.5.13 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5410
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

More Details >

RT Mega Menu <= 1.5.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14855
Patch Status

Unpatched
Published
Sep 17, 2026

Affected Software

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]

Researcher

More Details >

RT Mega Menu <= 1.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘pointer_menu_item’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15650
Patch Status

Unpatched
Published
Sep 17, 2026

Affected Software

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]

Researcher

More Details >

Strong Testimonials <= 3.3.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘lightbox_class’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-92622
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Strong Testimonials [strong-testimonials]

Researcher

More Details >

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘shopengine_product_title_header_size’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85575
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets [shopengine]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.19 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66608
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Visualizer <= 4.0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86784
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer]

Researcher

More Details >

VK All in One Expansion Unit <= 9.118.0 – Authenticated (Author+) Stored Cross-Site Scripting via ‘vkExUnit_cta_img_position’ Post Meta

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-17586
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

VK All in One Expansion Unit [vk-all-in-one-expansion-unit]

Researchers

More Details >

WP Composer <= 1.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘pbwp_raw_shortcode’ Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2422
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Composer – The Easiest Page Builder [page-builder-wp]

Researcher

More Details >

WPComplete <= 2.9.9.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ’empty’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-77820
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WPComplete [wpcomplete]

Researcher

More Details >

Xpro Elementor Addons <= 1.7.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84088
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons]

Researcher

More Details >

YayPricing – WooCommerce Dynamic Pricing & Discounts < 3.5.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-87888
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

YayPricing – WooCommerce Dynamic Pricing & Discounts [yaypricing]

Researcher

More Details >

YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-1256
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress [ysleadgen]

Researchers

More Details >

Add User Autocomplete < 1.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-87759
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Add User Autocomplete [add-user-autocomplete]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia < 2.4.10 – Authenticated (Custom Role+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-77705
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

PuppyFW <= 0.4.4 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-88904
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

PuppyFW [puppyfw]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 – Authenticated (Author+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-80071
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4.4.6 – 5.2.7 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-86406
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 – Reflected Cross-Site Scripting via ‘icn’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-18555
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

Booking Calendar <= 11.8.2 – Reflected Cross-Site Scripting via ‘options’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92561
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Design Scuole Italia <= 2.18.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-87793
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

design-scuole-wordpress-theme [design-scuole-wordpress-theme]

Researcher(s): Unknown

More Details >

Dictionary <= 1.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2025-15697
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Dictionary [dictionary]

Researcher

More Details >

EmbedPress <= 4.6.5 – Reflected Cross-Site Scripting via ‘hash’ and ‘unique’ Parameters

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-89330
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress]

Researcher

More Details >

Estatik <= 4.3.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-76790
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Estatik Real Estate Plugin [estatik]

Researcher

More Details >

LearnPress <= 4.4.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-86444
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

MC4WP: Mailchimp for WordPress <= 4.14.0 – Reflected Cross-Site Scripting via ‘data’ Dynamic Content Tag

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-87917
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

MC4WP: Mailchimp for WordPress [mailchimp-for-wp]

Researcher

More Details >

Newsletter <= 9.3.8 – Reflected Cross-Site Scripting via ‘nn’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-90981
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Newsletter – Send awesome emails from WordPress

Researcher

More Details >

Pochipp <= 1.20.2 – Reflected Cross-Site Scripting via ‘keyword’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92967
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Pochipp [pochipp]

Researcher

More Details >

Qi Addons For Elementor <= 1.11 – Reflected DOM-Based Cross-Site Scripting via ‘s’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92249
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Qi Addons For Elementor [qi-addons-for-elementor]

Researcher

More Details >

Realtyna Organic IDX plugin + WPL Real Estate <= 5.4.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-91014
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

More Details >

ShopLentor <= 3.5.1 – Reflected Cross-Site Scripting via Query-String Parameter Name

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92554
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]

Researcher

More Details >

SSL Zen <= 4.7.42 – Reflected Cross-Site Scripting via ‘uri’ and ‘host’ Parameters

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-15463
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

SSL Zen — SSL Certificate Installer & HTTPS Redirects [ssl-zen]

Researcher

More Details >

Tutor LMS <= 4.0.8 – Reflected Cross-Site Scripting via ‘back_url’ and ‘search’ Parameters

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-89081
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

WP Customer Reviews <= 3.7.8 – Reflected Cross-Site Scripting via ‘wpcr3_fname’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-11608
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Customer Reviews [wp-customer-reviews]

Researcher

More Details >

Import and export users and customers <= 2.4.4 – Authenticated (Administrator+) Server-Side Request Forgery

5.5

CVSS Rating
5.5 (Medium)
CVE-ID

CVE-2026-16542
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Administrator+) Server-Side Request Forgery

5.5

CVSS Rating
5.5 (Medium)
CVE-ID

CVE-2026-76559
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

WordPress Core <= 7.1 – Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)

5.5

CVSS Rating
5.5 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 – Authenticated (Custom+) Missing Authorization to Limited Account Takeover

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-14311
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 – Authenticated (Author+) Stored Cross-Site Scripting via ‘profile_fields_user_email_value_prefix’ Parameter

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-85657
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors [publishpress-authors]

Researcher

More Details >

FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 – Authenticated (Author+) Stored Cross-Site Scripting

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-15004
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

FileBird – WordPress Media Library Folders & File Manager [filebird]

Researcher

More Details >

Newsletter <= 9.3.6 – Unauthenticated Open Redirect

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-86823
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Newsletter [newsletter-email-mailing-list]

Researcher

More Details >

WP Recipe Maker <= 10.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘notes’ Parameter via REST Preview Endpoint

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-90884
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

3D FlipBook <= 1.16.20 – Unauthenticated Sensitive Information Exposure in ‘id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-15758
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery [interactive-3d-flipbook-powered-physics-engine]

Researcher

More Details >

Ad Inserter <= 2.8.16 – Missing Authorization to Unauthenticated Header/Footer Code Disclosure via ‘ai-debug-code’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11984
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

All-in-One WP Migration and Backup <= 7.110 – Unauthenticated Insufficient Credential Protection via Authorization Basic Header

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89064
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

All-in-One WP Migration and Backup [all-in-one-wp-migration]

Researcher

More Details >

Appointment Hour Booking <= 1.5.94 – Unauthenticated Appointment Slot Capacity Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86475
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Appointment Hour Booking – Booking Calendar [appointment-hour-booking]

Researcher

More Details >

Autopay <= 5.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90923
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Autopay [platnosci-online-blue-media]

Researcher

More Details >

BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript <= 4.1.15 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78528
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript [searchpro]

Researcher

More Details >

Better Messages <= 2.15.33 – Unauthenticated Information Exposure Spoofing via ‘X-Real-IP’ Header via /guests/register

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89093
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

Booking Calendar <= 11.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-74002
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia <= 2.4.5 – Missing Authorization to Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-16582
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Bookly <= 28.1 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91847
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Botiga Pro <= 1.6.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86591
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Botiga Pro [botiga-pro]

Researcher

More Details >

Bread <= 2.9.12 – Missing Authorization to Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-4792
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Bread [bread]

Researcher

More Details >

Breeze Cache <= 2.5.14 – Unauthenticated Cache Poisoning

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-79713
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Breeze Cache [breeze]

Researcher

More Details >

Clean Login <= 1.18 – Unauthenticated Account Registration

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90976
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Clean Login [clean-login]

Researcher

More Details >

Clean Login <= 1.18 – Unauthenticated CAPTCHA Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90977
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Clean Login [clean-login]

Researcher

More Details >

Design Scuole Italia <= 2.17.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87792
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

design-scuole-wordpress-theme [design-scuole-wordpress-theme]

Researcher(s): Unknown

More Details >

Divi 5.0 – 5.11.1 – Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via ‘content’ Parameter via Shortcode Module REST Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91707
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Divi [Divi]

Researcher

More Details >

Easy Appointments <= 4.0.2.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87965
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Easy Appointments 4.0 – 4.0.2.1 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87966
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Easy Form Builder 4.0.0 – 4.1.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85123
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]

Researcher

More Details >

Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.3.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66676
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Invoice – Invoice Generator, PDF Quotes & Payments [easy-invoice]

Researcher

More Details >

EduAdmin Booking <= 5.4.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62101
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

EduAdmin Booking [eduadmin-booking]

Researcher

More Details >

Event Booking Manager for WooCommerce <= 5.3.7 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91008
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

More Details >

Eventin <= 4.1.23 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84907
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Eventin <= 4.1.23 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-77702
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Eventin <= 4.1.23 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84906
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login <= 2.1.2 – Unauthenticated Email Verification Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78296
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login [fluent-security]

Researcher

More Details >

Formidable Forms <= 6.34 – Unauthenticated Content Injection

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85641
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable]

Researcher

More Details >

Ghost (Hide My WP Ghost) <= 7.0.10 – Unauthenticated Login Protection Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86800
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Hide My WP Ghost – Security & Firewall [hide-my-wp]

Researcher

More Details >

Ghost (Hide My WP Ghost) <= 7.0.10 – Unauthenticated Protection Mechanism Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86796
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Hide My WP Ghost – Security & Firewall [hide-my-wp]

Researcher

More Details >

GPTranslate <= 2.34.6 – Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89278
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI [gptranslate]

Researcher

More Details >

Ibtana – Ecommerce Product Addons <= 0.4.7.7 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via ‘iepa_use_gt_editor’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-1984
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Ibtana – Ecommerce Product Addons [ibtana-ecommerce-product-addons]

Researcher

More Details >

JWT Authentication for WP REST APIs <= 4.7.0 – Unauthenticated Authentication Method Downgrade via ‘mo_rest_api_test_config’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89027
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

JWT Authentication for WP REST APIs [wp-rest-api-authentication]

Researcher

More Details >

KBoard <= 6.6 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88910
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

kboard [kboard]

Researcher

More Details >

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66575
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

LearnPress <= 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86445
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LearnPress <= 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86447
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LearnPress <= 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86449
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LearnPress <= 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86448
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LearnPress 4.4.3 – 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86446
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

Mailchimp for WooCommerce <= 6.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92435
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Mailchimp for WooCommerce [mailchimp-for-woocommerce]

Researchers

More Details >

Master Addons for Elementor <= 3.1.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91015
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits [master-addons]

Researcher

More Details >

Meow Gallery <= 5.5.4 – Unauthenticated Arbitrary Shortcode Execution

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92422
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Meow Gallery [meow-gallery]

Researcher

More Details >

MgoSync 2.1.5 – 2.1.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92404
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

MgoSync – European dropshipping and suppliers [megamo]

Researchers

More Details >

Motors – Car Dealership & Classified Listings <= 1.4.120 – Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-16750
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researchers

More Details >

Motors <= 1.4.120 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91016
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Newsletter <= 9.3.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86824
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Newsletter [newsletter-email-mailing-list]

Researcher

More Details >

Ni WooCommerce Sales Report <= 4.1.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78474
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard [ni-woocommerce-sales-report]

Researcher

More Details >

Paid Member Subscriptions <= 3.0.8 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90922
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

More Details >

Payment Gateway for PayPal on WooCommerce <= 9.2.0 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92400
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Payment Gateway for PayPal on WooCommerce [woo-paypal-gateway]

Researcher

More Details >

Payment Gateway of Stripe for WooCommerce <= 5.0.8 – Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9832
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Payment Gateway of Stripe for WooCommerce [payment-gateway-stripe-and-woocommerce-integration]

Researcher

More Details >

Really Simple Security (Free) <= 9.8.2 – Unauthenticated Unbounded Option Growth

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88798
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl]

Researcher

More Details >

Rede Itaú for WooCommerce <= 5.4.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92430
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit [woo-rede]

Researchers

More Details >

RestroPress <= 3.4.5 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85010
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

RestroPress – Online Food Ordering System [restropress]

Researcher

More Details >

RestroPress <= 3.4.7 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85009
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

RestroPress – Online Food Ordering System [restropress]

Researcher

More Details >

Robokassa payment gateway for Woocommerce <= 1.8.8 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91017
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Robokassa payment gateway for Woocommerce [robokassa]

Researcher

More Details >

Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87891
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]

Researcher

More Details >

Rox Appointment Booking <= 1.2.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87896
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]

Researcher

More Details >

Rox Appointment Booking <= 1.2.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87907
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]

Researcher

More Details >

Schema & Structured Data for WP & AMP <= 1.65 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82124
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

Schema & Structured Data for WP & AMP <= 1.65 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82125
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

Secure Custom Fields <= 6.9.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92403
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Secure Custom Fields [secure-custom-fields]

Researcher

More Details >

Subscriptions for WooCommerce <= 2.0.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87854
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

More Details >

TikTok <= 1.4.1 – Missing Authorization to Unauthenticated TikTok Integration Takeover via ‘auth_code’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-18346
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

TikTok [tiktok-for-business]

Researcher

More Details >

TikTok 1.2.0 – 1.4.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92965
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

TikTok [tiktok-for-business]

Researcher

More Details >

To Do List Member <= 1.6 – Unauthenticated Content Injection

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86802
Patch Status

Unpatched
Published
Sep 18, 2026

Affected Software

To Do List Member [todo-lists-for-membership-sites]

Researchers

More Details >

Tripzzy <= 1.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87840
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tripzzy – Travel Engine System [tripzzy]

Researchers

More Details >

Tripzzy <= 1.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87839
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tripzzy – Travel Engine System [tripzzy]

Researchers

More Details >

UpsellWP <= 2.2.9 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85350
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

UpsellWP – Upsell and Related Products Offers for WooCommerce [checkout-upsell-and-order-bumps]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-74017
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WordLift <= 3.54.10 – Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9289
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WordLift – AI powered SEO – Schema [wordlift]

Researcher

More Details >

WPGraphQL Smart Cache <= 2.3.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92099
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WPGraphQL Smart Cache [wpgraphql-smart-cache]

Researcher

More Details >

Zonify – Amazon Product Importer for WooCommerce < 1.0.5 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87842
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Zonify – Amazon Product Importer for WooCommerce [zonify]

Researchers

More Details >

GoPay for WooCommerce <= 1.0.36 – Authenticated (Shop Manager+) SQL Injection via ‘log_table_filter’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-75959
Patch Status

Unpatched
Published
Sep 18, 2026

Affected Software

GoPay for WooCommerce [gopay-gateway]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) Arbitrary File Read

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-76555
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-76553
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-76557
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-76556
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66630
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]

Researcher

More Details >

MoreConvert Wishlist for WooCommerce <= 1.9.21 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66631
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

MoreConvert Wishlist for WooCommerce [smart-wishlist-for-more-convert]

Researcher

More Details >

Newsletters <= 4.18 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66619
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

NEX-Forms <= 9.3.0 – Authenticated (Administrator+) SQL Injection via ‘operator’ Key of the ‘additional_params’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-75961
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

SKT Addons for Elementor <= 4.0 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66626
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

SKT Addons for Elementor [skt-addons-for-elementor]

Researcher

More Details >

Store Exporter <= 2.8.0 – Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via ‘filename’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-16777
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers [woocommerce-exporter]

Researcher

More Details >

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66625
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors [wc-vendors]

Researcher

More Details >

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.9 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66618
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin]

Researcher

More Details >

WP Mega Menu <= 1.4.2 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-92465
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

WP Mega Menu [wp-megamenu]

Researcher

More Details >

WP Optimizer <= 2.5.0 – Authenticated (Administrator+) SQL Injection via ‘s’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-6295
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals [wp-optimizer]

Researcher

More Details >

WP-Lister Lite for eBay <= 3.8.11 – Authenticated (Shop Manager+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66628
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP-Lister Lite for eBay [wp-lister-for-ebay]

Researcher

More Details >

WPMasterToolKit (WPMTK) – All in one plugin <= 2.22.0 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66624
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WPMasterToolKit (WPMTK) – All in one plugin [wpmastertoolkit]

Researcher

More Details >

All-in-One WP Migration and Backup <= 7.110 – Authenticated (Admin+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-81810
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

All-in-One WP Migration and Backup [all-in-one-wp-migration]

Researcher

More Details >

Design Scuole Italia <= 2.17.3 – Open Redirect

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-89307
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

design-scuole-wordpress-theme [design-scuole-wordpress-theme]

Researcher(s): Unknown

More Details >

Import Export Lite <= 3.9.34 – Authenticated (Admin+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-76554
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

LiteSpeed Cache <= 7.9 – Reflected Cross-Site Scripting via ESI ‘esi’ Parameter

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-76579
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

More Details >

WP Ghost (Hide My WP Ghost) <= 7.0.02 – Unauthenticated Open Redirect via ‘redirect_to’ Parameter

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-7527
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Hide My WP Ghost – Security & Firewall [hide-my-wp]

Researcher

More Details >

Business Name Generator <= 1.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2025-15698
Patch Status

Unpatched
Published
Sep 17, 2026

Affected Software

Business Name Generator [designbro-business-name-generator]

Researcher

More Details >

CSS & JavaScript Toolbox <= 12.0.6 – Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2025-13533
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

CSS & JavaScript Toolbox [css-javascript-toolbox]

Researcher

More Details >

OTP Login & Register Woocommerce <= 2.7.3 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘fb-config’ Setting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12402
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

OTP Login & Register Woocommerce [mobile-login-woocommerce]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data

4.4

CVSS Rating
4.4 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP2Social Auto Publish <= 2.4.12 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘pages’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12042
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP2Social Auto Publish [facebook-auto-publish]

Researcher

More Details >

Active Products Tables for WooCommerce <= 2.1.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91009
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Active Woot Products Tables for WooCommerce. 100% FREE  [profit-products-tables-for-woocommerce]

Researcher

More Details >

Asset CleanUp: Page Speed Booster <= 1.4.0.5 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-66571
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Asset CleanUp: Page Speed Booster [wp-asset-clean-up]

Researcher

More Details >

AVideo <= 29.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92579
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

aVideo [avideo]

Researcher

More Details >

BlockSpare – Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 – Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-1242
Patch Status

Unpatched
Published
Sep 18, 2026

Affected Software

BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for News, Magazine & Blogs [blockspare]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 – Authenticated (Subscriber+) Username Enumeration

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89029
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 – Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89031
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89030
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Bookit <= 2.6.0.4 – Authenticated (Bookit Staff+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89008
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Bookit — Booking & Appointment Calendar [bookit]

Researcher

More Details >

Bookit <= 2.6.0.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89007
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Bookit — Booking & Appointment Calendar [bookit]

Researcher

More Details >

Checkout Field Manager <= 7.9.6 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87829
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]

Researchers

More Details >

Checkout Field Manager <= 7.9.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87831
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]

Researcher

More Details >

Comments Import & Export 2.1.11 – 2.5.3 – Authenticated (Author+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87836
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Comments Import & Export [comments-import-export-woocommerce]

Researcher

More Details >

Cooked – Recipe Management <= 1.16.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-73999
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Cooked – Recipe Management [cooked]

Researcher

More Details >

Datalogics Ecommerce Delivery <= 2.6.65 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9613
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Datalogics Ecommerce Delivery – Datalogics [datalogics]

Researcher

More Details >

Empik for Woocommerce <= 1.5.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9766
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Empik for Woocommerce [empik-for-woocommerce]

Researcher

More Details >

Event Booking Manager for WooCommerce <= 5.5.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91019
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

More Details >

Eventin <= 4.1.23 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84905
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Export & Import WPBakery Page Builder <= 1.0.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81429
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

Export & Import WPBakery Page Builder [vc-templates-import-export]

Researcher

More Details >

Filter Gallery <= 1.1.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-90978
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Filter Gallery [filter-gallery]

Researcher

More Details >

Filter Gallery <= 1.1.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via ‘image_id’ Parameter via ufg_save_gallery AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89138
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Filter Gallery [filter-gallery]

Researcher

More Details >

Flex Import <= 3.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via ‘license_activate_fleximp’ and ‘license_deactivate_fleximp’ AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9615
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Flex Import [flex-import]

Researcher

More Details >

FluentBoards <= 2.0.14 – Authenticated (Board Member+) Comment Author Spoofing

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89327
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

More Details >

FluentBoards <= 2.0.14 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85349
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

More Details >

FluentBoards <= 2.0.14 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89328
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

More Details >

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via ‘option_key’ Parameter of toggle_watermark AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18317
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images [foxtool]

Researcher

More Details >

Hydra Booking <= 1.2.1 – Authenticated (Hydra Host+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92420
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]

Researcher

More Details >

Hydra Booking <= 1.2.2 – Authenticated (Hydra Host+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92421
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]

Researcher

More Details >

Hydra Booking <= 1.2.3 – Authenticated (Hydra Host+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92425
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]

Researcher

More Details >

Invisible Anti-Spam & CAPTCHA <= 5.1.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91010
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms [gdpr-compliant-recaptcha-for-all-forms]

Researcher

More Details >

Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-74005
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]

Researcher

More Details >

King Addons for Elementor <= 51.1.80 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84903
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

King Addons for Elementor 51.1.56 – 51.1.80 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84904
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

LatePoint – Appointment Booking & Scheduling <= 5.6.9 – Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via ‘customer[id]’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18441
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

LatePoint <= 5.6.3 – Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-13471
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researchers

More Details >

Magazine Blocks <= 1.8.6 – Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-75017
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Authenticated (Instructor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88844
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Authenticated (Instructor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81340
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

Meow Gallery <= 5.5.4 – Authenticated (Author+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92423
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Meow Gallery [meow-gallery]

Researcher

More Details >

MultiVendorX <= 5.0.15 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-74926
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Admin+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81654
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81652
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

Nimble Builder <= 3.3.8 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-16557
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Nimble Page Builder [nimble-builder]

Researcher

More Details >

Partial Shipment for Woocommerce <= 3.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9858
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Partial Shipment for WooCommerce [wc-partial-shipment]

Researcher

More Details >

PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 – Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11899
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]

Researcher

More Details >

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.1 – Missing Authorization to 2FA Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82519
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl]

Researcher

More Details >

Schema & Structured Data for WP & AMP <= 1.65 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82126
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

Search Atlas SEO <= 2.6.23 – Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via ‘metasync_post_types’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15947
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Search Atlas SEO – OTTO AI SEO Automation for WordPress [metasync]

Researcher

More Details >

Search Atlas SEO <= 2.6.23 – Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15946
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Search Atlas SEO – OTTO AI SEO Automation for WordPress [metasync]

Researcher

More Details >

SEO Booster <= 7.4.7 – Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15660
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

SEO Booster [seo-booster]

Researcher

More Details >

Seraphinite Accelerator <= 2.29.23 – Authenticated (Subscriber+) Full Admin Area Denial of Service

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87828
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Seraphinite Accelerator [seraphinite-accelerator]

Researcher

More Details >

Sign-up Sheets <= 2.3.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92410
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Sign-up Sheets [sign-up-sheets]

Researcher

More Details >

Simple Membership <= 4.8.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-74000
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

More Details >

Subscriptions for WooCommerce <= 2.0.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87860
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

More Details >

Tutor LMS <= 4.0.7 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85572
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Tutor LMS <= 4.0.8 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via ‘lesson_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88944
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Tutor LMS 2.7.1 – 4.0.7 – REST API Authentication Confusion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85569
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Unbounce Landing Pages <= 1.1.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85574
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Unbounce Landing Pages [unbounce]

Researcher

More Details >

VW Writer Blog <= 1.3.8 – Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-2278
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

VW Writer Blog [vw-writer-blog]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Contributor+) Path Traversal via REST Templates Controller

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Forced Theme Install/Preview and Selector Injection via Theme Installer Route

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP Easy Pay <= 4.5.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12739
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Easy Pay – Payment and Donation Form Builder for Square [wp-easy-pay]

Researcher

More Details >

WPBot 8.7.2 – 8.7.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87959
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services [chatbot]

Researcher

More Details >

WPLP Cookie Consent <= 4.4.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85131
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-78295
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility [xagio-seo]

Researcher

More Details >

WordPress Core <= 7.1 – HTML API set_modifiable_text() Comment Boundary Break

3.7

CVSS Rating
3.7 (Low)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Admin+) Insecure Direct Object Reference

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-81653
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Admin+) Insecure Direct Object Reference

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-81651
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)

2.7

CVSS Rating
2.7 (Low)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026) appeared first on Wordfence.

]]> PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core https://swiftupdates.ca/psa-critical-unauthenticated-path-traversal-vulnerability-patched-in-wordpress-core/ Tue, 22 Sep 2026 23:40:24 +0000 https://swiftupdates.ca/psa-critical-unauthenticated-path-traversal-vulnerability-patched-in-wordpress-core/

On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 (Critical).

The vulnerability can allow an unauthenticated attacker to make WordPress include a readable PHP file from outside the active theme directory. If the site’s active theme and server environment meet the necessary conditions, the included file can provide a path to remote code execution and complete site compromise.

We strongly recommend that all WordPress site owners update immediately and confirm that the update completed successfully. Although exploitation depends on the site’s theme layout and the presence of a suitable local PHP file, the vulnerable behavior is in WordPress Core, requires no account, and can be reached over the internet.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule protecting against attacks targeting this vulnerability on September 22, 2026, the day the vulnerability was disclosed. Wordfence Free users will receive the same protection on October 22, 2026, following the standard 30-day delay.

Key takeaways:
  • CVE-2026-87902 is a critical unauthenticated path traversal and local PHP file inclusion vulnerability in WordPress Core.
  • Successful exploitation does not require a WordPress account or user interaction.
  • Remote code execution is conditional. The active parent or child theme must contain a suitable top-level page-* directory, and the server must contain a readable PHP file that has useful behavior when included.
  • The official advisory cites legacy Twenty Twelve and Twenty Fourteen, as well as Neve, Hestia, and Sydney, as examples of themes with the relevant directory layout. Administrators should verify their installed theme and filesystem rather than infer exposure from a theme name alone.
  • WordPress 7.1.2 contains the fix. WordPress also released security backports for branches 7.0 through 4.7.
  • Wordfence Premium, Care, and Response customers received firewall protection on September 22, 2026. Wordfence Free users will receive the same protection on October 22, 2026.
  • Site owners should update to the fixed release for their branch immediately. Firewall protection reduces exposure but is not a replacement for updating WordPress Core.

Vulnerability Summary from Wordfence Intelligence

WordPress Core <= 7.1.1 – Unauthenticated Local File Inclusion via locate_template() Path Traversal

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-87902
Affected Version(s)
Various
Patched Versions
4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2

Affected Software

WordPress [wordpress]

Researcher

WordPress Core is vulnerable to Local File Inclusion via the locate_template() function in various versions up to, and including, 7.1.1. The function resolved a caller-supplied template name against the theme directories without verifying the result stayed within them, so a template name containing ‘..’ could resolve to a readable PHP file outside the active theme and be included. The core-reachable vector is get_page_template(), which builds page-{$pagename}.php from the URL-derived, url-decoded ‘pagename’ query variable. This makes it possible for unauthenticated attackers to make page-template resolution include a chosen readable local .php file outside the theme directories, which under certain conditions can lead to remote code execution. Exploitation requires (1) the active parent or child theme to contain a top-level directory whose name begins with ‘page-‘ (e.g. ‘page-templates’ in Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney), and (2) a readable .php target on the server accessible to the web-server account (e.g. pearcmd.php with register_argc_argv=On, as in the official PHP Docker image and default cPanel setups on PHP < 8.5), which yields RCE.

More Details >

We would like to thank Robert Ressl for discovering and responsibly disclosing this vulnerability, as well as the WordPress Security Team and Core contributors who developed, reviewed, tested, and backported the fix.

What Makes This Vulnerability Serious

What makes this vulnerability serious is that it affects WordPress Core rather than a single optional plugin or theme. An attacker does not need to authenticate, convince an administrator to click a link, or find a separate privilege-escalation vulnerability before reaching the vulnerable page-template logic.

At the same time, it is important to describe the impact precisely. CVE-2026-87902 is not an unconditional remote code execution vulnerability on every unpatched WordPress site. The vulnerability first provides a path traversal and local PHP file inclusion primitive. Turning that primitive into code execution depends on the theme and server satisfying additional requirements.

The official advisory identifies two principal conditions:

  1. The active parent or child theme contains a top-level directory whose name begins with page-, such as page-templates.
  2. A PHP file that can produce useful behavior when included exists locally and is readable by the web server account.

The relevant directory layout exists in real themes. The WordPress advisory specifically cites the legacy Twenty Twelve and Twenty Fourteen themes, along with Neve, Hestia, and Sydney. Because the advisory does not identify affected theme-version ranges, administrators should verify the installed theme and filesystem rather than assume that every release bearing one of those names is exposed. The advisory also reports that the official PHP Docker image and default cPanel configurations using PHP before 8.5 can expose a known PEAR-based transition from local file inclusion to code execution.

Sites that do not meet those requirements may not be exploitable for remote code execution in their current configuration. That should not be treated as a durable mitigation. Themes, plugins, PHP packages, and server settings change over time, and the underlying unauthenticated path traversal remains present until WordPress Core is updated.

Technical Analysis

WordPress uses a hierarchy of candidate files to decide which template should render a page. In vulnerable releases, get_page_template() reads the public pagename query variable and applies an additional URL-decoding operation before constructing a template candidate:

$pagename_decoded = urldecode( $pagename );
$templates[]      = "page-{$pagename_decoded}.php";

Request parameters have already been URL-decoded once by the time WordPress processes them. The extra urldecode() means an attacker can submit a doubly encoded value that becomes path traversal syntax only during page-template resolution.

WordPress then passes the candidate to locate_template(). In affected versions, that function joins the candidate to an active-theme path and checks whether the resulting file exists. It did not verify that the resolved file remained inside an approved theme directory before load_template() included it.

Together, these behaviors allow a crafted page request to escape a compatible page-* directory and point WordPress toward a PHP file elsewhere on the local filesystem. WordPress adds the page- prefix and .php suffix itself, which is why the theme layout and target-file requirements matter.

Our end-to-end validation reproduced the behavior on WordPress 7.1.

How the Patch Works

The WordPress fix adds two complementary protections.

First, get_page_template() now checks the decoded page name with validate_file() before adding it to the template candidate list. This rejects the traversal syntax used through the vulnerable pagename path.

Second, locate_template() now sends existing candidates through a new _wp_is_template_path_allowed() check. For a path containing traversal components, WordPress resolves its canonical filesystem location and confirms that it remains inside an approved theme or theme-compatibility directory before it can be loaded.

The first control closes the known request path. The second adds defense in depth for other Core callers and filters that can provide template names.

Who Is Affected

The vulnerable and fixed ranges are branch-specific. A simple statement such as “WordPress 7.1.1 and earlier” would be inaccurate because the September 22 security backports are fixed even though their version numbers sort below 7.1.1.

Affected versions Update to
7.1.0 through 7.1.1 7.1.2
7.0.0 through 7.0.5 7.0.6
6.9.0 through 6.9.8 6.9.9
6.8.0 through 6.8.9 6.8.10
6.7.0 through 6.7.8 6.7.9
6.6.0 through 6.6.8 6.6.9
6.5.0 through 6.5.11 6.5.12
6.4.0 through 6.4.11 6.4.12
6.3.0 through 6.3.11 6.3.12
6.2.0 through 6.2.12 6.2.13
6.1.0 through 6.1.13 6.1.14
6.0.0 through 6.0.15 6.0.16
5.9.0 through 5.9.17 5.9.18
5.8.0 through 5.8.16 5.8.17
5.7.0 through 5.7.18 5.7.19
5.6.0 through 5.6.20 5.6.21
5.5.0 through 5.5.21 5.5.22
5.4.0 through 5.4.22 5.4.23
5.3.0 through 5.3.24 5.3.25
5.2.0 through 5.2.27 5.2.28
5.1.0 through 5.1.25 5.1.26
5.0.0 through 5.0.28 5.0.29
4.9.0 through 4.9.32 4.9.33
4.8.0 through 4.8.31 4.8.32
4.7.0 through 4.7.36 4.7.37

WordPress.org states that only the newest release in the 7.1 series is actively maintained. The older fixes were supplied as courtesy security backports. Sites on an older branch should apply the available security update immediately and plan an upgrade to a currently maintained WordPress release.

Wordfence Protection

Wordfence Premium, Wordfence Care, and Wordfence Response customers received firewall protection against attacks targeting CVE-2026-87902 on September 22, 2026, the same day the vulnerability and security updates were released. Wordfence Free users will receive the same protection on October 22, 2026.

The dedicated firewall rule detects traversal syntax in the vulnerable pagename input, including the encoded form that remains after the web application firewall’s first decoding pass.

As always, the firewall is an important layer of protection, but it is not a substitute for patching WordPress Core. Site owners should update even after firewall protection is active.

What Site Owners Should Do Now

If you manage a WordPress site, take the following steps immediately:

1

Check the WordPress Core version on every site you manage.
2

Update to WordPress 7.1.2 or to the fixed release listed above for your current branch.
3

Confirm that the update completed. Do not assume an automatic background update succeeded on every site.
4

If immediate updating is temporarily impossible, confirm that an appropriate firewall rule is active, then schedule the Core update as soon as possible.
5

Review web server and firewall logs for suspicious requests containing traversal-like values in the pagename parameter.
6

If you find evidence that a request reached the vulnerable template path, treat the site as potentially compromised. Review administrator accounts, recently installed or modified plugins, scheduled tasks, and unexpected PHP files, and begin a full incident response process.

Conclusion

CVE-2026-87902 is a serious WordPress Core vulnerability because it is reachable without authentication and can cross a theme-directory boundary to include local PHP code. On sites with a compatible theme layout and server environment, successful exploitation can lead to remote code execution and full site compromise.

The environmental requirements mean that not every vulnerable WordPress installation is immediately exploitable for code execution. They do not make it safe to remain on an affected release. The correct remediation is to update WordPress Core to the fixed version for your branch and confirm that the update completed.

Wordfence Premium, Care, and Response customers received firewall protection on September 22, 2026, and Wordfence Free users will receive the same protection on October 22, 2026. Patching remains the most important step site owners can take.

If you have not already verified that your sites are running WordPress 7.1.2 or the appropriate September 22 security backport, do that now.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care.

If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both products include hands-on support if you need further assistance.

Primary Sources

The post PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core appeared first on Wordfence.

]]>